File name:

SpongebobNoSleep2.exe

Full analysis: https://app.any.run/tasks/d58e55b1-1485-4641-a875-6a4ed87b050e
Verdict: Malicious activity
Analysis date: June 24, 2024, 22:33:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B05FBD1BFD40E5632C36341D1F4CAE47

SHA1:

383DF2DFD995236DB0C5ABCF84D867F2117215E7

SHA256:

D090C4B65F8F3145301E612F6007996C2408A140FBFD09B608CEE3D4A273FF26

SSDEEP:

196608:HB5HVbnvf/tlSZSKWdPcYpdo5V30UsnzKTFQCZ+nE2bZq3WFGuUa:DVrnVlitW0MowTnzwFv+ZqGFdl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SpongebobNoSleep2.exe (PID: 3128)
      • cmd.exe (PID: 3152)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 3164)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3164)

    • Task Manager has been disabled (taskmgr)

      • gdifuncs.exe (PID: 4032)

    • Modify registry editing tools (regedit)

      • gdifuncs.exe (PID: 4032)

    • Changes the login/logoff helper path in the registry

      • gdifuncs.exe (PID: 4032)

    • Disables Windows Defender

      • gdifuncs.exe (PID: 4032)

    • Disables the Run the Start menu

      • gdifuncs.exe (PID: 4032)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SpongebobNoSleep2.exe (PID: 3128)

    • Runs WScript without displaying logo

      • wscript.exe (PID: 3164)

    • Executable content was dropped or overwritten

      • SpongebobNoSleep2.exe (PID: 3128)
      • cmd.exe (PID: 3152)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 3164)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 3164)

    • The process executes VB scripts

      • SpongebobNoSleep2.exe (PID: 3128)

    • Reads the Internet Settings

      • wscript.exe (PID: 3164)
      • SpongebobNoSleep2.exe (PID: 3128)

    • Executing commands from ".cmd" file

      • wscript.exe (PID: 3164)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3164)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3164)

    • Creates file in the systems drive root

      • cmd.exe (PID: 3152)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3152)

    • Changes the desktop background image

      • reg.exe (PID: 3476)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 3152)

    • Creates or modifies Windows services

      • gdifuncs.exe (PID: 4032)

  • INFO

    • Checks supported languages

      • SpongebobNoSleep2.exe (PID: 3128)
      • mbr.exe (PID: 2432)
      • MainWindow.exe (PID: 4028)
      • gdifuncs.exe (PID: 4032)

    • Create files in a temporary directory

      • SpongebobNoSleep2.exe (PID: 3128)

    • Reads the computer name

      • SpongebobNoSleep2.exe (PID: 3128)
      • gdifuncs.exe (PID: 4032)

    • Reads the machine GUID from the registry

      • gdifuncs.exe (PID: 4032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:02:01 20:46:09+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 66048
InitializedDataSize: 10260992
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.6.6.6
ProductVersionNumber: 5.6.6.6
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Private build
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileVersion: 5.6.6.6
ProductVersion: 5.6.6.6
ProductName: SpongebobNoSleep2
OriginalFileName: HorrorBob5.exe
InternalName: HorrorBob5
FileDescription: SPONGEBOB IS WATCHING YOU!
CompanyName: HorrorTrojans
LegalCopyright: 2022
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
43
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start spongebobnosleep2.exe wscript.exe no specs mbr.exe no specs cmd.exe reg.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs mainwindow.exe no specs gdifuncs.exe spongebobnosleep2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
524RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
568RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
764RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1172RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1476RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1596RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1620RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1828RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2136RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
13 108
Read events
11 542
Write events
1 566
Delete events
0

Modification events

(PID) Process:(3128) SpongebobNoSleep2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3128) SpongebobNoSleep2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3128) SpongebobNoSleep2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3128) SpongebobNoSleep2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3164) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3164) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3164) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3164) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3476) reg.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
c:\bg.bmp
(PID) Process:(3164) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Speech\CurrentUserLexicon
Operation:writeName:CLSID
Value:
{C9E37C15-DF92-4727-85D6-72E5EEB6995A}
Executable files
4
Suspicious files
2
Text files
10
Unknown types
195

Dropped files

PID
Process
Filename
Type
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\mainbgtheme.wav —
MD5:—
SHA256:—
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\gdifuncs.exeexecutable
MD5:E254E9598EE638C01E5CCC40E604938B
SHA256:4040AD3437E51139819148ED6378828ADCFBD924251AF39DE8BF100A3A476A63
3164wscript.exeC:\Users\admin\Desktop\SPONGEBOB_IS_WATCHING_YOU 3.txtsp
MD5:BB6D68D7181108015CD381C28360DFC4
SHA256:AEA8FB9235900760AC374C6A4A10FBA62C2A0EF5BEA2DD7EF4DB70FE55E0B317
3164wscript.exeC:\Users\admin\Desktop\SPONGEBOB_IS_WATCHING_YOU 1.txtsp
MD5:BB6D68D7181108015CD381C28360DFC4
SHA256:AEA8FB9235900760AC374C6A4A10FBA62C2A0EF5BEA2DD7EF4DB70FE55E0B317
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\MainWindow.exeexecutable
MD5:7C92316762D584133B9CABF31AB6709B
SHA256:01995C3715C30C0C292752448516B94485DB51035C3A4F86EB18C147F10B6298
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\tools.cmdtext
MD5:397C1A185B596E4D6A4A36C4BDCBD3B2
SHA256:56C7054C00A849648D3681D08536DC56C0FB637F1F1EC3F9E102EACE0A796A9F
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\mbr.cpptext
MD5:C448773E7BE4C2D476D24312C3F9D798
SHA256:AD46D48D2F55A77AEB0B68A69E8058D8DAEE166F267CAB488CAF3E8CBBA19D1E
3164wscript.exeC:\Users\admin\Desktop\SPONGEBOB_IS_WATCHING_YOU 6.txtsp
MD5:BB6D68D7181108015CD381C28360DFC4
SHA256:AEA8FB9235900760AC374C6A4A10FBA62C2A0EF5BEA2DD7EF4DB70FE55E0B317
3128SpongebobNoSleep2.exeC:\Users\admin\AppData\Local\Temp\F559.tmp\mbr.exeexecutable
MD5:33BD7D68378C2E3AA4E06A6A85879F63
SHA256:6E79302D7AE9CC69E4FD1BA77BD4315D5E09F7A173B55BA823D6069A587A2E05
3164wscript.exeC:\Users\admin\Desktop\SPONGEBOB_IS_WATCHING_YOU 2.txtsp
MD5:BB6D68D7181108015CD381C28360DFC4
SHA256:AEA8FB9235900760AC374C6A4A10FBA62C2A0EF5BEA2DD7EF4DB70FE55E0B317
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9f83325acc8ca75
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1372
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1372
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpongebobNoSleep2.exe