File name:

Galaxy Swapper v2.exe

Full analysis: https://app.any.run/tasks/8d3df4c7-af1a-4f51-9b5f-1c2f87f8e6e1
Verdict: Malicious activity
Analysis date: September 04, 2024, 20:23:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

CD1C931046A4C3A409324E063DAC7115

SHA1:

ADD3635130FE2171DF543FF70EF6D631DE2B0367

SHA256:

74246F654724B1BC50DB79B362E2A190CB9ACE52F8A0ECB18DB8F25E51CE6F78

SSDEEP:

98304:aXKiyqOhfdewOt4bMSDUUPXGxIJsjOj3++DsVDBO0JaYJGOAgFHmGHkgyDE66Fzw:OROVOypYjbDW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Galaxy Swapper v2.exe (PID: 7164)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Process drops legitimate windows executable

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 6000)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • msiexec.exe (PID: 7200)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 6000)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Searches for installed software

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)

    • Starts itself from another location

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7200)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7200)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7200)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7200)

    • Drops 7-zip archiver for unpacking

      • Galaxy Swapper v2.exe (PID: 1440)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 4784)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 6000)
      • Galaxy Swapper v2.exe (PID: 7164)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 7792)
      • msiexec.exe (PID: 7980)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • Galaxy Swapper v2.exe (PID: 1440)
      • msiexec.exe (PID: 8180)
      • msiexec.exe (PID: 8100)

    • The process uses the downloaded file

      • msedge.exe (PID: 5852)
      • msedge.exe (PID: 5140)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)

    • Reads the computer name

      • identity_helper.exe (PID: 4784)
      • Galaxy Swapper v2.exe (PID: 7164)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • msiexec.exe (PID: 7200)
      • msiexec.exe (PID: 7792)
      • msiexec.exe (PID: 8180)
      • msiexec.exe (PID: 7980)
      • msiexec.exe (PID: 8100)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Application launched itself

      • msedge.exe (PID: 5140)

    • Reads Environment values

      • identity_helper.exe (PID: 4784)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 5140)
      • msiexec.exe (PID: 7200)

    • Create files in a temporary directory

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 6000)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)

    • Process checks computer location settings

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7600)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Reads the machine GUID from the registry

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • msiexec.exe (PID: 7200)

    • Sends debugging messages

      • Galaxy Swapper v2.exe (PID: 7164)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Reads the software policy settings

      • msiexec.exe (PID: 7200)
      • Galaxy Swapper v2.exe (PID: 1440)
      • slui.exe (PID: 7920)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7200)

    • Creates files in the program directory

      • windowsdesktop-runtime-7.0.20-win-x64.exe (PID: 7708)
      • Galaxy Swapper v2.exe (PID: 1440)

    • Manual execution by a user

      • Galaxy Swapper v2.exe (PID: 1440)
      • mspaint.exe (PID: 5520)
      • mspaint.exe (PID: 6412)

    • Creates files or folders in the user directory

      • Galaxy Swapper v2.exe (PID: 1440)

    • Checks proxy server information

      • Galaxy Swapper v2.exe (PID: 1440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (27.1)
.exe | Win32 EXE PECompact compressed (generic) (26.2)
.exe | Win32 Executable MS Visual C++ (generic) (19.6)
.exe | Win64 Executable (generic) (17.4)
.dll | Win32 Dynamic Link Library (generic) (4.1)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:17 06:58:08+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 104960
InitializedDataSize: 59392
UninitializedDataSize: -
EntryPoint: 0x140e0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Galaxy Swapper v2
FileDescription: Galaxy Swapper v2
FileVersion: 1
InternalName: Galaxy Swapper v2.dll
LegalCopyright: Copyright © Galaxy Swapper v2
OriginalFileName: Galaxy Swapper v2.dll
ProductName: Galaxy Swapper v2
ProductVersion: 1.0.0+5ebd3eccca0981f2cdae2aa9ca4d2784a527f8db
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
59
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start galaxy swapper v2.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs windowsdesktop-runtime-7.0.20-win-x64.exe windowsdesktop-runtime-7.0.20-win-x64.exe windowsdesktop-runtime-7.0.20-win-x64.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe no specs msiexec.exe no specs mspaint.exe no specs msedge.exe no specs msedge.exe no specs mspaint.exe no specs msedge.exe no specs galaxy swapper v2.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
788"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5808 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1440"C:\Users\admin\Downloads\Galaxy Swapper v2.exe" C:\Users\admin\Downloads\Galaxy Swapper v2.exe
explorer.exe
User:
admin
Company:
Galaxy Swapper v2
Integrity Level:
MEDIUM
Description:
Galaxy Swapper v2
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\downloads\galaxy swapper v2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2008"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5512 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2340"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8036 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3112"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5632 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1628 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3500 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3448"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5260 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3784"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x31c,0x320,0x324,0x314,0x32c,0x7fffd3b55fd8,0x7fffd3b55fe4,0x7fffd3b55ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2328,i,10730708429349437524,6227710867720673118,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
21 345
Read events
20 354
Write events
945
Delete events
46

Modification events

(PID) Process:(7164) Galaxy Swapper v2.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7164) Galaxy Swapper v2.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7164) Galaxy Swapper v2.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7164) Galaxy Swapper v2.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5140) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5140) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5140) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5140) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5140) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
FFEB913CE77F2F00
(PID) Process:(5140) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
40B0963CE77F2F00
Executable files
491
Suspicious files
156
Text files
93
Unknown types
15

Dropped files

PID
Process
Filename
Type
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF12b202.TMP —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF12b202.TMP —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF12b231.TMP —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF12b241.TMP —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF12b202.TMP —
MD5:—
SHA256:—
5140msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF12b241.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
74
DNS requests
80
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1448
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5140
msedge.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
7376
svchost.exe
HEAD
200
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
7080
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7896
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7376
svchost.exe
GET
206
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
7376
svchost.exe
GET
206
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
7376
svchost.exe
GET
206
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
7376
svchost.exe
GET
206
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
7376
svchost.exe
GET
206
217.20.58.99:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cea821c9-eb81-47bf-8df8-0a52010d0e39?P1=1726041779&P2=404&P3=2&P4=dlKMKcL3hx61wOYHXCLauMjIiwjtjc%2fPg1HY41t6Gz%2fyvA0T4GIkzUtH1246oYI2F3orrnFejBf5Zad4CJ9LUQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7080
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4316
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
5524
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5524
msedge.exe
2.22.34.124:443
aka.ms
AKAMAI-AS
IT
whitelisted
5524
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5524
msedge.exe
94.245.104.56:443
api.edgeoffer.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5524
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.72.205.209
whitelisted
google.com
  • 142.250.185.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
aka.ms
  • 2.22.34.124
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
api.edgeoffer.microsoft.com
  • 94.245.104.56
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
bzib.nelreports.net
  • 23.50.131.21
  • 23.50.131.30
whitelisted
dotnet.microsoft.com
  • 13.107.246.45
  • 13.107.246.60
whitelisted

Threats

No threats detected
Process
Message
Galaxy Swapper v2.exe
You must install .NET to run this application. App: C:\Users\admin\Downloads\Galaxy Swapper v2.exe Architecture: x64 App host version: 7.0.20 .NET location: Not found Learn about runtime installation: https://aka.ms/dotnet/app-launch-failed Download the .NET runtime: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=7.0.20
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Successfully created log file at 9/4/2024 8:25 PM
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Version: 1.46
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Backend Version: 1.46
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Settings Version: 1.00
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Runtime: .NET 7.0.20
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] OS Version: Microsoft Windows 10.0.19045
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Config: C:\Users\admin\AppData\Local\GalaxySwapper-InGame
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] C:\ProgramData\Epic\UnrealEngineLauncher\LauncherInstalled.dat does not exist
Galaxy Swapper v2.exe
[9/4/2024 8:25 PM] [INF] Wrote settings file to C:\Users\admin\AppData\Local\GalaxySwapper-InGame\Settings.json
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Galaxy Swapper v2.exe