8a06bb79f400aec933cd8badd5b63df54da5b02b95cf7c0ea29e0cdb40f72e6e

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy-Swapper-v2-main/Workspace/Assets/oo2core_5_win64.dll
Size 927KB
Sample261024-qa5deshz8z
SHA256 8a06bb79f400aec933cd8badd5b63df54da5b02b95cf7c0ea29e0cdb40f72e6e
MD5 847752c164e051c8acad50232c9ed2b7
SHA1 717eee612c95c807e40ebaad670d9faa55313eb8
SHA512 d4ac133dba5aec7b90a6f577687d6d6349474d9a9273bb8e6362948ac3b25f722571bfa7d2154cd1fbd3a9bcd76532e73aa4a2f6e5ccc9d33d478f8cedf44d1d
SSDEEP 24576:SkGhT2823V6LmHE2/QvTvO+KYsqJAkdHs3D:aT2F8aHE1vTvO+cq2+4
TLSH
T182159E13B2D956ECD677C13C8AB75616F2B0748903609AFB56A449762F27FE0273E302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Galaxy-Swapper-v2-main\Workspace\Assets\oo2core_5_win64.dll,#1
1⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,1277489149986208339,15257920214040964699,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2184 /prefetch:3
1⤵
- System Time Discovery
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,6365759759147845010,6972480326874739044,262144 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2068 /prefetch:2
1⤵
PID:5048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,3871999389167266871,16348188237318272957,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:8
1⤵
PID:4500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3272,i,8835599344010410052,4756617272474158584,2097152 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
1⤵
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3076,i,14907020788349538247,16195458891388690394,2097152 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
1⤵
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4536,i,2219488461176386526,11024465125422034262,2097152 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4568 /prefetch:1
1⤵
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,1851476130021460167,2101751602017131820,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:8
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,11373878530602269176,17270698597558756984,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
1⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,11893953856824740014,14807610076992096192,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:8
1⤵
PID:332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,8704783027390477857,1127583839444221524,524288 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5656 /prefetch:8
1⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,14846040384796430218,11135649147880420471,262144 --field-trial-handle=2072,i,17069858239989395535,11286036838395380122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ce84549a-7ef6-4b03-a632-f4e3fbe30d80.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ce84549a-7ef6-4b03-a632-f4e3fbe30d80.tmp
Size 2KB
SHA256 25c01b09095a00fec5c70dc37db0c42208da983994de9fef09ba290277f00e2e
MD5 6bdd37f7d532f17c8c6e3e5088e8cbd6
SHA1 9f9233b5394303f2d277b5e2becaa9ba5e076e5b
SHA512 3d9614ff5753af14f76e9be84dc67114ec699ed21641306196f20f6e58a3a8779ed866e83bf9277d361bb1b3b17eafb38ef13ffb3dafe8636ab3a391867b5e83
TLSH
T1C1418DF7D7E4857E851166F49B11BE1FCD3E0A14121C3C6289D4EE5B43E2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

e5d18590-6a40-4b0e-b31c-a517aa45298f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e5d18590-6a40-4b0e-b31c-a517aa45298f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download