Edit tour

Windows Analysis Report
GalacticShooter (3).exe

Overview

General Information

Sample Name:	GalacticShooter (3).exe
Analysis ID:	847587
MD5:	83024ea067ab552d39ffdb6e12a30817
SHA1:	23d6b96f806e1ca8a10dfa16e7f35b3f2801a489
SHA256:	f96f3a4f4cdab5176a055736464d979f7cbd902298c910cbbdb08e955695bf73
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Tries to harvest and steal browser information (history, passwords, etc)

May check the online IP address of the machine

Uses 32bit PE files

Drops files with a non-matching file extension (content does not match file extension)

Queries the volume information (name, serial number etc) of a device

Drops PE files

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Queries keyboard layouts

Enables security privileges

PE file contains more sections than normal

Found dropped PE file which has not been started or loaded

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Searches for user specific document files

Classification

Process Tree

System is w10x64

GalacticShooter (3).exe (PID: 7152 cmdline: C:\Users\user\Desktop\GalacticShooter (3).exe MD5: 83024EA067AB552D39FFDB6E12A30817)

GalacticShooter.exe (PID: 648 cmdline: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe MD5: 93BD0AE322D0293B5AFF20C25B1F71A2)

GalacticShooter.exe (PID: 5020 cmdline: "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 93BD0AE322D0293B5AFF20C25B1F71A2)

GalacticShooter.exe (PID: 6760 cmdline: "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --mojo-platform-channel-handle=2012 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 93BD0AE322D0293B5AFF20C25B1F71A2)

GalacticShooter.exe (PID: 4852 cmdline: "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --app-path="C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6097977297 --mojo-platform-channel-handle=2372 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 93BD0AE322D0293B5AFF20C25B1F71A2)

cleanup

HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Host: ajax.googleapis.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) GalacticShooter/1.0.0 Chrome/100.0.4896.143 Electron/18.2.3 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US

Source: C:\Users\user\Desktop\GalacticShooter (3).exe	File created: C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\GalacticShooter (3).exe	File created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\LICENSE.electron.txt			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	DNS query: name: ipinfo.io

Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233
Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.106

Source: da.pak.0.dr	String found in binary or memory: http://eksempel.dk
Source: GalacticShooter (3).exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: da.pak.0.dr	String found in binary or memory: https://eksempel.dk.Brug
Source: ro.pak.0.dr, da.pak.0.dr, fr.pak0.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: es.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es

Source: global traffic	HTTP traffic detected: GET /dns-query?dns=AAABAAABAAAAAAABA3d3dwdnc3RhdGljA2NvbQAAAQABAAApEAAAAAAAAFQADABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1Host: dns.googleConnection: keep-aliveAccept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /dns-query?dns=AAABAAABAAAAAAABBGFqYXgKZ29vZ2xlYXBpcwNjb20AAAEAAQAAKRAAAAAAAABQAAwATAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1Host: dns.googleConnection: keep-aliveAccept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1Host: ajax.googleapis.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) GalacticShooter/1.0.0 Chrome/100.0.4896.143 Electron/18.2.3 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US

Source: GalacticShooter.exe.0.dr	Static PE information: Number of sections : 13 > 10
Source: GalacticShooter.exe0.0.dr	Static PE information: Number of sections : 13 > 10

Source: unknown	Process created: C:\Users\user\Desktop\GalacticShooter (3).exe C:\Users\user\Desktop\GalacticShooter (3).exe
Source: C:\Users\user\Desktop\GalacticShooter (3).exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --mojo-platform-channel-handle=2012 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --app-path="C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6097977297 --mojo-platform-channel-handle=2372 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\Desktop\GalacticShooter (3).exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --mojo-platform-channel-handle=2012 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process created: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe "C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\GalacticShooter" --app-path="C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6097977297 --mojo-platform-channel-handle=2372 --field-trial-handle=1808,i,15278089115020680940,8688177150396165339,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: GalacticShooter.exe.0.dr	Static PE information: section name: .00cfg
Source: GalacticShooter.exe.0.dr	Static PE information: section name: .retplne
Source: GalacticShooter.exe.0.dr	Static PE information: section name: .rodata
Source: GalacticShooter.exe.0.dr	Static PE information: section name: CPADinfo
Source: GalacticShooter.exe.0.dr	Static PE information: section name: _RDATA
Source: GalacticShooter.exe.0.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: .00cfg
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: .retplne
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: .rodata
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: CPADinfo
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: _RDATA
Source: GalacticShooter.exe0.0.dr	Static PE information: section name: malloc_h
Source: libEGL.dll1.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll1.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll1.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll1.0.dr	Static PE information: section name: _RDATA
Source: a29c34ab-b943-477c-ac6f-48afff1de174.tmp.node.10.dr	Static PE information: section name: .didat
Source: a29c34ab-b943-477c-ac6f-48afff1de174.tmp.node.10.dr	Static PE information: section name: .00cfg
Source: a29c34ab-b943-477c-ac6f-48afff1de174.tmp.node.10.dr	Static PE information: section name: _RDATA
Source: 00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node.10.dr	Static PE information: section name: .didat
Source: 00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node.10.dr	Static PE information: section name: .00cfg
Source: 00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node.10.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File created: C:\Users\user\AppData\Local\Temp\a29c34ab-b943-477c-ac6f-48afff1de174.tmp.node			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File created: C:\Users\user\AppData\Local\Temp\00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node			Jump to dropped file

Source: C:\Users\user\Desktop\GalacticShooter (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GalacticShooter (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GalacticShooter (3).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000409			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\00000409			Jump to behavior

Source: C:\Users\user\Desktop\GalacticShooter (3).exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File Volume queried: C:\Users\user\AppData\Roaming\GalacticShooter\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File Volume queried: C:\Users\user\AppData\Roaming\GalacticShooter\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File Volume queried: C:\Users\user\AppData\Roaming\GalacticShooter\blob_storage\76d81e7a-d76e-4351-923b-d3acb571a189 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	File Volume queried: C:\Users\user\AppData\Roaming\GalacticShooter\Cache\Cache_Data FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Autofill Data.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Autofill Data.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies\Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies\Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Credit Cards.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Credit Cards.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Autofill Data.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Autofill Data.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies\Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Cookies\Chrome_Default.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Credit Cards.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Credit Cards.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user\Passwords.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\epsilon-user.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	11 Process Injection	11 Masquerading	1 OS Credential Dumping	1 Remote System Discovery	Remote Services	11 Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Process Injection	LSASS Memory	1 System Network Configuration Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
GalacticShooter (3).exe	6%	ReversingLabs
GalacticShooter (3).exe	3%	Virustotal		Browse

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\a29c34ab-b943-477c-ac6f-48afff1de174.tmp.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\GalacticShooter.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso54DD.tmp\nsis7z.dll	0%	ReversingLabs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GalacticShooter (3).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\00569f07-e2e7-4e9a-a29a-45eaa7608008.tmp.node

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\GalacticShooter.exe

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\icudtl.dat

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\libEGL.dll

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\libGLESv2.dll

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\am.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\ar.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\bg.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\bn.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\ca.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\cs.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\da.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\de.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\el.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\en-GB.pak

C:\Users\user\AppData\Local\Temp\2ONWRcI5GZ6reM4AjlGk3S9hVCy\locales\en-US.pak

Windows Analysis Report
GalacticShooter (3).exe

Source	Detection	Scanner	Link
discord.com	0%	Virustotal	Browse
dns.google	1%	Virustotal	Browse
rentry.co	1%	Virustotal	Browse
canary.discord.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label
http://eksempel.dk	0%	URL Reputation	safe
https://dns.google/dns-query?dns=AAABAAABAAAAAAABA3d3dwdnc3RhdGljA2NvbQAAAQABAAApEAAAAAAAAFQADABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	0%	URL Reputation	safe
https://dns.google/dns-query?dns=AAABAAABAAAAAAABBGFqYXgKZ29vZ2xlYXBpcwNjb20AAAEAAQAAKRAAAAAAAABQAAwATAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	0%	Avira URL Cloud	safe
https://eksempel.dk.Brug	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.138.232	true	false	0%, Virustotal, Browse	unknown
ipinfo.io	34.117.59.81	true	false		high
rentry.co	198.251.88.130	true	false	1%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.130.233	true	false		high
canary.discord.com	162.159.128.233	true	false	0%, Virustotal, Browse	unknown
dns.google	8.8.8.8	true	false	1%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://dns.google/dns-query?dns=AAABAAABAAAAAAABBGFqYXgKZ29vZ2xlYXBpcwNjb20AAAEAAQAAKRAAAAAAAABQAAwATAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	false	Avira URL Cloud: safe	unknown
https://dns.google/dns-query?dns=AAABAAABAAAAAAABA3d3dwdnc3RhdGljA2NvbQAAAQABAAApEAAAAAAAAFQADABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	false	URL Reputation: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://eksempel.dk.Brug	da.pak.0.dr	false	Avira URL Cloud: safe	unknown
http://eksempel.dk	da.pak.0.dr	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	GalacticShooter (3).exe	false		high
https://support.google.com/chrome/answer/6098869?hl=es	es.pak.0.dr	false		high
https://support.google.com/chrome/answer/6098869	ro.pak.0.dr, da.pak.0.dr, fr.pak0.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
162.159.138.232	discord.com	United States	13335	CLOUDFLARENETUS	false
198.251.88.130	rentry.co	United States	53667	PONYNETUS	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
162.159.128.233	canary.discord.com	United States	13335	CLOUDFLARENETUS	false
8.8.4.4	unknown	United States	15169	GOOGLEUS	false
142.250.184.106	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	847587
Start date and time:	2023-04-16 15:04:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	GalacticShooter (3).exe
Detection:	MAL
Classification:	mal48.troj.spyw.winEXE@9/186@9/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.130.233	PO Details.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	cdn.discordapp.com/attachments/956928735397965906/1011525020427763732/KqRRf17.jpb
	quote.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	cdn.discordapp.com/attachments/956928735397965906/1011024921868116099/ljkfuP193.ttf
	MSQNZmmg2F.exe	Get hash	malicious	Vidar	Browse	cdn.discordapp.com/attachments/898638713985302540/898905970657345626/al.exe
	b7cwlpwH6S.exe	Get hash	malicious	Amadey RedLine SmokeLoader	Browse	cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe
	order-confirmation.doc__.rtf	Get hash	malicious	AgentTesla	Browse	cdn.discordapp.com/attachments/843685789120331799/847476783744811018/OtI.exe
	Order Confirmation.doc	Get hash	malicious	AgentTesla	Browse	cdn.discordapp.com/attachments/843685789120331799/847476783744811018/OtI.exe
	cfe14e87_by_Libranalysis.rtf	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/520353354304585730/839557970173100102/ew.exe
	SkKcQaHEB8.exe	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
	P20200107.DOC	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
	FBRO ORDER SHEET - YATSAL SUMMER 2021.exe	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/832005460982235229/836405556838924308/usd.exe
	SKM_C258 Up21042213080.exe	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/832005460982235229/834717762281930792/12345.exe
	SKM_C258 Up21042213080.exe	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/832005460982235229/834717762281930792/12345.exe
	G019 & G022 SPEC SHEET.exe	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/832005460982235229/834598381472448573/23456.exe
	Marking Machine 30W Specification.exe	Get hash	malicious	Azorult Vidar	Browse	cdn.discordapp.com/attachments/832005460982235229/834598381472448573/23456.exe
	2021 RFQ Products Required.doc	Get hash	malicious	Remcos	Browse	cdn.discordapp.com/attachments/821511904769998921/821511945881911306/panam.exe
	Company Reference1.doc	Get hash	malicious	Snake Keylogger	Browse	cdn.discordapp.com/attachments/819949436054536222/820935251337281546/nbalax.exe
	PAY SLIP.doc	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/788946375533789214/788947376849027092/atlasx.scr
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.25071.rtf	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/785423761461477416/785424240047947786/angelrawfile.exe
	part1.rtf	Get hash	malicious	AgentTesla	Browse	cdn.discordapp.com/attachments/783666652440428545/783667553490698250/kdot.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	PDA.PDF.js	Get hash	malicious	Vector Stealer	Browse	162.159.137.232
	choo.bin.exe	Get hash	malicious	Vector Stealer	Browse	162.159.128.233
	RFQ.PDF.js	Get hash	malicious	Vector Stealer	Browse	162.159.136.232
	obfuscated.js	Get hash	malicious	Vector Stealer	Browse	162.159.137.232
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	162.159.137.232
	aHESmFfQeP.exe	Get hash	malicious	DCRat	Browse	162.159.128.233
	Znci6Yzgb2.exe	Get hash	malicious	DCRat	Browse	162.159.138.232
	YcI9sKzcid.exe	Get hash	malicious	Babadeda	Browse	162.159.128.233
	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.7747.12321.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	Scan-Docs-ord09334rn-pdf.js	Get hash	malicious	AgentTesla	Browse	162.159.128.233
	v3NesZhLpp.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.136.232
	Dekont-c,pdf.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	162.159.137.232
	ffdh07v2cv.exe	Get hash	malicious	AgentTesla	Browse	162.159.136.232
	plM3DwAY4v.exe	Get hash	malicious	Stealerium	Browse	162.159.138.232
	hDgR1Ix672.exe	Get hash	malicious	Stealerium	Browse	162.159.128.233
	DiscordUpdater.exe	Get hash	malicious	Clipboard Hijacker, Stealerium	Browse	162.159.128.233
	SecuriteInfo.com.Win64.PWSX-gen.29890.2280.exe	Get hash	malicious	Vector Stealer	Browse	162.159.136.232
	SecuriteInfo.com.Win64.PWSX-gen.3187.26224.exe	Get hash	malicious	Vector Stealer	Browse	162.159.138.232
	r4Q6Ejjl24	Get hash	malicious	Unknown	Browse	162.159.128.233
	masked_fixxxx.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.128.233
ipinfo.io	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader	Browse	34.117.59.81
	Tria Health.html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	PDA.PDF.js	Get hash	malicious	Vector Stealer	Browse	34.117.59.81
	choo.bin.exe	Get hash	malicious	Vector Stealer	Browse	34.117.59.81
	Aging Balance_FULLDATE2_KM_C454e Hhtm.html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Aging Balance_FULLDATE2_KM_C454e Hhtm.html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Visual Persuasion LLC.html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	INV118231.INVEFTQT0313.HTM_	Get hash	malicious	Unknown	Browse	34.117.59.81
	Notice_12_apr_1483230.js	Get hash	malicious	NetSupport RAT	Browse	34.117.59.81
	Remittance File 0394038 038748.html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	https://newamerica31.com/vor6b	Get hash	malicious	NetSupport RAT, Phisher	Browse	34.117.59.81
	RFQ.PDF.js	Get hash	malicious	Vector Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader	Browse	34.117.59.81
	file.exe	Get hash	malicious	PrivateLoader	Browse	34.117.59.81
	ATT98089 .HTM	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Kindly View (2).html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Direct_Deposit.htm	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	PaymentReceipt#U00ae3142026.htm	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	obfuscated.js	Get hash	malicious	Vector Stealer	Browse	34.117.59.81
	http://fixedunitedfree.z13.web.core.windows.net	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://verfmogz.ffm.to/removeat	Get hash	malicious	Unknown	Browse	104.18.24.196
	ci2E8Tsgjx.elf	Get hash	malicious	Mirai	Browse	104.30.121.84
	Orden_de_compra_(P.O-4220986)_Diesel_OMT.exe	Get hash	malicious	Lokibot	Browse	104.21.14.55
	LRXUsX7M4x.elf	Get hash	malicious	Mirai	Browse	8.47.233.200
	PO_UYTTFCFGV.xlsx.exe	Get hash	malicious	FormBook	Browse	188.114.96.7
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Amadey, CryptOne, DanaBot, Djvu, SmokeLoader, Vidar	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader, Vidar	Browse	188.114.97.7
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Xmrig	Browse	104.20.67.143
	file.exe	Get hash	malicious	Amadey, Djvu, SmokeLoader	Browse	188.114.96.7
	txSu22RMwo.exe	Get hash	malicious	RedLine	Browse	172.67.34.170
	m9yVBGQjG1.xlsx	Get hash	malicious	Hidden Macro 4.0, Emotet	Browse	104.21.29.205
	AgmQcxN8Lf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	https://email.mail1.onesignal.os.tc/c/eJwUzz2uozAQAODT4G6Qf8ZmXFBsCqq9w2o89iwoJCDiSC-3f0r_NR-f57-tziicStUKZG0BnKhBieogBCyFIqtHNHVOGHNV02aXyEWXnCezzlONVFkDsyuc1frmi7ZIiVpLafJmmyefS8rWgToqgBwEMlOEkrIKi0ryadxb71cb0O6H8L4er272ee39fA3hz-CXwS_y7n3cP4Nffqa_9XZbzPPom27CfTue34kE9o1KBRsnBaScgIIKOB-tuiLJEppz50-7vtzaUF2KETK6CZCQIFcJwIRFIlanQc01v94Xf8Y7rxc_-Dmgrdv_rb-v-yjHY-zXbwAAAP__0aBhnA	Get hash	malicious	Unknown	Browse	172.67.8.238
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader	Browse	188.114.96.7
	vH2hK89wai.exe	Get hash	malicious	MinerDownloader, Laplas Clipper, RedLine, Xmrig	Browse	104.20.67.143
	file.exe	Get hash	malicious	RedLine, Xmrig	Browse	172.67.34.170
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Fabookie, SmokeLoader	Browse	188.114.96.7
CLOUDFLARENETUS	https://verfmogz.ffm.to/removeat	Get hash	malicious	Unknown	Browse	104.18.24.196
	ci2E8Tsgjx.elf	Get hash	malicious	Mirai	Browse	104.30.121.84
	Orden_de_compra_(P.O-4220986)_Diesel_OMT.exe	Get hash	malicious	Lokibot	Browse	104.21.14.55
	LRXUsX7M4x.elf	Get hash	malicious	Mirai	Browse	8.47.233.200
	PO_UYTTFCFGV.xlsx.exe	Get hash	malicious	FormBook	Browse	188.114.96.7
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Amadey, CryptOne, DanaBot, Djvu, SmokeLoader, Vidar	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader, Vidar	Browse	188.114.97.7
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Laplas Clipper, SmokeLoader	Browse	188.114.96.7
	setup.exe	Get hash	malicious	Xmrig	Browse	104.20.67.143
	file.exe	Get hash	malicious	Amadey, Djvu, SmokeLoader	Browse	188.114.96.7
	txSu22RMwo.exe	Get hash	malicious	RedLine	Browse	172.67.34.170
	m9yVBGQjG1.xlsx	Get hash	malicious	Hidden Macro 4.0, Emotet	Browse	104.21.29.205
	AgmQcxN8Lf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.7
	https://email.mail1.onesignal.os.tc/c/eJwUzz2uozAQAODT4G6Qf8ZmXFBsCqq9w2o89iwoJCDiSC-3f0r_NR-f57-tziicStUKZG0BnKhBieogBCyFIqtHNHVOGHNV02aXyEWXnCezzlONVFkDsyuc1frmi7ZIiVpLafJmmyefS8rWgToqgBwEMlOEkrIKi0ryadxb71cb0O6H8L4er272ee39fA3hz-CXwS_y7n3cP4Nffqa_9XZbzPPom27CfTue34kE9o1KBRsnBaScgIIKOB-tuiLJEppz50-7vtzaUF2KETK6CZCQIFcJwIRFIlanQc01v94Xf8Y7rxc_-Dmgrdv_rb-v-yjHY-zXbwAAAP__0aBhnA	Get hash	malicious	Unknown	Browse	172.67.8.238
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader	Browse	188.114.96.7
	vH2hK89wai.exe	Get hash	malicious	MinerDownloader, Laplas Clipper, RedLine, Xmrig	Browse	104.20.67.143
	file.exe	Get hash	malicious	RedLine, Xmrig	Browse	172.67.34.170
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Fabookie, SmokeLoader	Browse	188.114.96.7