d59371c88cd287e0e9704ca0a39bfbb1a5436312d253ccee407d7e3e1c628906

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-05-2023 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GOG_Galaxy_Ghostrunner.exe
Size

498KB
MD5

7637e6a3ec95ffee2d83689f200c3015
SHA1

bb99cf1cf097e5b58c9b68629ab58fb491441f91
SHA256

d59371c88cd287e0e9704ca0a39bfbb1a5436312d253ccee407d7e3e1c628906
SHA512

5d6e7245c6dcaae6aa244a2d26a51587f1f0fd1a92a96f83d1e19f67e4e9516d04a81abff258eb40206eeab9eb46378f9743ba02d5fbeb4e8a5bf7f06fb5a4ab
SSDEEP

12288:X/Qgxsoz8Og3FPb5kBCpDGRlvDKAB2sPaVeOx:v4TDFP3o/vDKKFPaJ

Score

8^/10

discovery evasion persistence trojan upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
732	GalaxyInstaller.exe
2016	GalaxySetup.exe
1616	GalaxySetup.tmp
1128	VC_redist.x86.exe
764	VC_redist.x86.exe
1748	VC_redist.x64.exe
1908	VC_redist.x64.exe
1932	GalaxyClient.exe
2784	GalaxyClientService.exe

Loads dropped DLL 60 IoCs

pid	Process
1432	GOG_Galaxy_Ghostrunner.exe
1432	GOG_Galaxy_Ghostrunner.exe
1432	GOG_Galaxy_Ghostrunner.exe
1432	GOG_Galaxy_Ghostrunner.exe
2016	GalaxySetup.exe
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1128	VC_redist.x86.exe
764	VC_redist.x86.exe
1616	GalaxySetup.tmp
1748	VC_redist.x64.exe
1908	VC_redist.x64.exe
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
1932	GalaxyClient.exe
1932	GalaxyClient.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe
2352	WerFault.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1432-54-0x0000000000400000-0x000000000051C000-memory.dmp	upx
behavioral1/memory/1432-81-0x0000000000400000-0x000000000051C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	GalaxyClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\GogGalaxy = "C:\\Program Files (x86)\\GOG Galaxy\\GalaxyClient.exe /launchViaAutoStart"	GalaxyClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	GalaxySetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\GalaxyClient	GalaxySetup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GalaxyClient.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GOG Galaxy\web\images\discover\welcomeOfferCovers\is-K96JM.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\attr\is-JAELK.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\psutil\is-JK3VD.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\licences\zlib\is-UO5QA.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\is-OSEQJ.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\multidict\is-0TIBM.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\multidict\is-6657C.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\is-A62GU.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-EGMOH.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\.hash\is-8PBQD.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-NBUPC.tmp	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\python\vcruntime140.dll	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\python\pythonw.exe	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\is-ID46D.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-BIGRV.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-V95S1.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-07PQ5.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-A2ELJ.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\audio\is-EQER0.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\is-CVIJP.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-5A6FO.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-89I2K.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\dateutil\zoneinfo\is-EOERI.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\angularLocales\is-9MFN2.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-696QR.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-4CMUC.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\attr\is-B09AF.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\chardet\is-96GAG.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\chardet\is-GRDQB.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\locales\ja-JP\is-OOP1N.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-ME05F.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-P3IE9.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-RLS01.tmp	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\python\python3.dll	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\yarl\is-5UJMJ.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\is-GO5FD.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\locales\pt-BR\is-64IBP.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-NB0H6.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-OHHEE.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-QBNLJ.tmp	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\PocoXml.dll	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\swiftshader\libEGL.dll	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-0VHPA.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\dateutil\is-JU7KP.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\dateutil\parser\is-8O1UC.tmp	GalaxySetup.tmp
File opened for modification	C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\is-VBS41.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\idna\is-TSJ9C.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\images\gameImgPlaceholders\is-8U1L0.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\is-1Q1M3.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\attr\is-NRQDC.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\galaxy\is-LTT0M.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-O4GHN.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\locales\zh-Hant\is-PL75E.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-U003K.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\psutil\is-EKVBT.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-JSG17.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\is-HMB6N.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\galaxy\is-DUC9A.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\is-VCA05.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-CT9I0.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\galaxy\is-QRJOG.tmp	GalaxySetup.tmp
File created	C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\multidict\_multilib\is-AP4PV.tmp	GalaxySetup.tmp

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-4CH4D.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-6M3B7.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-D11AF.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-74DP1.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-QF4T1.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-N8SP9.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-4EHFP.tmp	GalaxySetup.tmp
File created	C:\Windows\Fonts\is-BQ85G.tmp	GalaxySetup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	1932	WerFault.exe	38

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	GOG_Galaxy_Ghostrunner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	GOG_Galaxy_Ghostrunner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	GalaxyClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	GalaxyClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	GalaxyClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	GalaxyClient.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1616	GalaxySetup.tmp
1616	GalaxySetup.tmp
1932	GalaxyClient.exe
1932	GalaxyClient.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe
2784	GalaxyClientService.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	732	GalaxyInstaller.exe
Token: SeTakeOwnershipPrivilege	1932	GalaxyClient.exe
Token: SeRestorePrivilege	1932	GalaxyClient.exe
Token: SeTakeOwnershipPrivilege	1932	GalaxyClient.exe
Token: SeRestorePrivilege	1932	GalaxyClient.exe
Token: SeTakeOwnershipPrivilege	2784	GalaxyClientService.exe
Token: SeRestorePrivilege	2784	GalaxyClientService.exe
Token: SeTakeOwnershipPrivilege	2784	GalaxyClientService.exe
Token: SeRestorePrivilege	2784	GalaxyClientService.exe
Token: SeTakeOwnershipPrivilege	2784	GalaxyClientService.exe
Token: SeRestorePrivilege	2784	GalaxyClientService.exe
Token: SeTakeOwnershipPrivilege	2784	GalaxyClientService.exe
Token: SeRestorePrivilege	2784	GalaxyClientService.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	GalaxySetup.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	GalaxyClient.exe
2784	GalaxyClientService.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 732	1432	GOG_Galaxy_Ghostrunner.exe	30
PID 1432 wrote to memory of 732	1432	GOG_Galaxy_Ghostrunner.exe	30
PID 1432 wrote to memory of 732	1432	GOG_Galaxy_Ghostrunner.exe	30
PID 1432 wrote to memory of 732	1432	GOG_Galaxy_Ghostrunner.exe	30
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 732 wrote to memory of 2016	732	GalaxyInstaller.exe	31
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 2016 wrote to memory of 1616	2016	GalaxySetup.exe	32
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1616 wrote to memory of 1128	1616	GalaxySetup.tmp	34
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1128 wrote to memory of 764	1128	VC_redist.x86.exe	35
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1616 wrote to memory of 1748	1616	GalaxySetup.tmp	36
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1748 wrote to memory of 1908	1748	VC_redist.x64.exe	37
PID 1616 wrote to memory of 1932	1616	GalaxySetup.tmp	38
PID 1616 wrote to memory of 1932	1616	GalaxySetup.tmp	38
PID 1616 wrote to memory of 1932	1616	GalaxySetup.tmp	38
PID 1616 wrote to memory of 1932	1616	GalaxySetup.tmp	38
PID 1932 wrote to memory of 2352	1932	GalaxyClient.exe	41
PID 1932 wrote to memory of 2352	1932	GalaxyClient.exe	41
PID 1932 wrote to memory of 2352	1932	GalaxyClient.exe	41
PID 1932 wrote to memory of 2352	1932	GalaxyClient.exe	41

C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_Ghostrunner.exe
"C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_Ghostrunner.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe" 1957528513 "Ghostrunner"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1957528513 /silent /game_name="Ghostrunner"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\is-U3HUD.tmp\GalaxySetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U3HUD.tmp\GalaxySetup.tmp" /SL5="$1016E,271706050,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1957528513 /silent /game_name="Ghostrunner"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe" /install /quiet /norestart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\Temp\{E96E481C-EB83-44F7-A762-E66D5BFD7E4D}\.cr\VC_redist.x86.exe
        
        "C:\Windows\Temp\{E96E481C-EB83-44F7-A762-E66D5BFD7E4D}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe" /install /quiet /norestart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\Temp\{4F02EB64-3D9E-4770-B829-9312D78952C8}\.cr\VC_redist.x64.exe
        
        "C:\Windows\Temp\{4F02EB64-3D9E-4770-B829-9312D78952C8}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1908
    - - C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
        
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks whether UAC is enabled
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 584
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2352

C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
"C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoData.dll

Filesize
1.7MB

MD5
7818a804fa9fd0f9a09263b6b35325fc

SHA1
590971157aa72d48f7939556a7554bc9d8975cd5

SHA256
f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416

SHA512
63a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll

Filesize
372KB

MD5
dd7065f6e3bd80c6e7e6419e2475c8a8

SHA1
f01ce83abf97c075fdad042cf6e3f994110ceb78

SHA256
0c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c

SHA512
00656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll

Filesize
1.7MB

MD5
3e72226a19d731e0d0baa1e9a2017dd7

SHA1
d1ea639b8a0532f9ce092861016f79d672dcef25

SHA256
97190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8

SHA512
eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll

Filesize
338KB

MD5
c645048dcbff4fd35d51a254c18dc131

SHA1
a3c9b97073d69318979a4d1bb66f02edc7ccdd88

SHA256
ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53

SHA512
421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoNet.dll

Filesize
1.3MB

MD5
8fbf4845c06da70e17e40376244b97ba

SHA1
488bb2cfc96dbe103425b9657ddfd646aae4388c

SHA256
fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b

SHA512
c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll

Filesize
526KB

MD5
9cb7c18b68e61c0eac049a3d7d0b970c

SHA1
83f17545fc35c2e1a0b627236309d8c0933a67d3

SHA256
0d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609

SHA512
9bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4

Download Submit
C:\Program Files (x86)\GOG Galaxy\PocoXML.dll

Filesize
539KB

MD5
ed29d945a6e4ab83974d783e5a910d20

SHA1
4a008b7dcd527fd2ad6b0e4211f431a983104605

SHA256
c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e

SHA512
8d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f

Download Submit
C:\Program Files (x86)\GOG Galaxy\Qt5Core.dll

Filesize
5.1MB

MD5
ecd2fed8765416bf429f32f14cc5c747

SHA1
00f09763508c58be76a0ef0b348358a0802d4745

SHA256
e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8

SHA512
77d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057

Download Submit
C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll

Filesize
5.6MB

MD5
68c19f9f45a98734a6e42745a75ff2d3

SHA1
1f39560b10ab2bf6f3fab76a3be5f305b169fcaa

SHA256
1233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329

SHA512
df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41

Download Submit
C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll

Filesize
1.0MB

MD5
9dcd0f88d822d9e8f5d72dc15f53fb71

SHA1
5e06d4ec06f720a06320bf660fe5f34a460af200

SHA256
99dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5

SHA512
cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a

Download Submit
C:\Program Files (x86)\GOG Galaxy\libexpat.dll

Filesize
173KB

MD5
657d32eec34d3225b38262a5878e9474

SHA1
22daaca36c1d49bdb8b2851f40596d4cd025dcb0

SHA256
ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62

SHA512
d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895

Download Submit
C:\Program Files (x86)\GOG Galaxy\pcre2-8.dll

Filesize
576KB

MD5
6ff65827e6191c4aebe6d611341ae02e

SHA1
41ecaa87dcc727340e6358251a08d3bab240b58e

SHA256
a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544

SHA512
85d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33

Download Submit
C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-E8JI4.tmp

Filesize
987KB

MD5
562e8efa4422fdab66fd48ae64dfc7a5

SHA1
22d7f566adfd42c6c18c5a2e2ccd5d5a3bd49706

SHA256
73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303

SHA512
b513c177f8dc6edd26391af045bbbd57fc31c3346cc78ae1083373247e08405416198682e773a33991b6f311cd4f65fd2656cb55c63668499494eb7454852f0a

Download Submit
C:\Program Files (x86)\GOG Galaxy\sqlite.dll

Filesize
802KB

MD5
570163e4b53390b17bf78af85e8af01d

SHA1
e642d74d485c4a3ed3a339ff3f2497b06033ccf2

SHA256
dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a

SHA512
6ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc

Download Submit
C:\Program Files (x86)\GOG Galaxy\unins000.exe

Filesize
3.3MB

MD5
d4d2a2f5b5fff481cac8d7b11578fab5

SHA1
210d87bdcf3bb9860c513a856b0c395288111255

SHA256
92826c668ebc5ef58fbb1a57a1b88fef61c0070edbb0bae25bdef65091680571

SHA512
8b262ab93c6018fdb59c37eca0168b13507c349814d536b752b3227bb071f93fa1f80e1318187dce30d01be8514d253e7c6deb050f9d4a484dba20a7f5d8988e

Download Submit
C:\Program Files (x86)\GOG Galaxy\web\is-RK5QA.tmp

Filesize
27KB

MD5
f6f79d474faa8870a9378b048571cc9f

SHA1
e4364b1522bd8e77ed00593209753b2eeee9d8db

SHA256
4a6d0dd3e6b99e5d1e6b05c414ac284068b8517f7c3dc1083e8f201635e83174

SHA512
a5dad42f44429ae1d8f04ba2bb06353df741cbe0748a4fe707c9be3c46d8217cd96bc606309a2a8570856e9cafc650102ccfba3e47d66b2299a563160c0d3f71

Download Submit
C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-9M756.tmp

Filesize
1KB

MD5
bf804964f529597485b5aa66f76656d8

SHA1
1625addc939cf41ad6677ed2330da32d656d3496

SHA256
4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0

SHA512
6c9009c448830cd678be6d6edc28ee5e936ce25ff100c93df66ad24a8f93fc21739ffe80e27d94f400736cf76ae7735ddb7568ffa68ae23a0f566396eb6c4413

Download Submit
C:\Program Files (x86)\GOG Galaxy\xdelta3.dll

Filesize
131KB

MD5
9cfacd6bb21d545f154a3ec82aaf9d93

SHA1
1bbee4abe68031b38256c0f4584adb6aed95ce7b

SHA256
57f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953

SHA512
71f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a

Download Submit
C:\Program Files (x86)\GOG Galaxy\zlib1.dll

Filesize
104KB

MD5
2a92f0dc6dac8545718ee475b7b961ed

SHA1
c154cdcf10e411f1622e29a7f019ae610f35ddf1

SHA256
3c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890

SHA512
190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234

Download Submit
C:\ProgramData\GOG.com\Galaxy\changelogs\is-6NGPH.tmp

Filesize
38KB

MD5
4ce143770a3afb2d1005ecef87319043

SHA1
67f4b63535fe977ecf5fa6213e6cbe3b4a375628

SHA256
7ff90a4dd45006cbe6e2e619213230610f1c6c19c7e3b659403e43e656c8373a

SHA512
ca944a89d988b1d6499e79b6425dd0fc8393519d4205815fdc7b5678fc7dc4169816b603d8f007d64b82906215cca790d0f8cdf3f1b47353c2c51133be5b4614

Download Submit
C:\ProgramData\GOG.com\Galaxy\config.json

Filesize
268B

MD5
0983ab2871e1f03d0d78954b0e78ded8

SHA1
c15910cdc2a98840d4731cb477d497dfea23387c

SHA256
375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093

SHA512
87a497a9f216fd7dddaa2ef7e0a9ed930ca5634811de5da124b4444b9aea9e755b434770cd6a1921b5f3b7e10fbafab0f442946122765b016f0a28e38e623f3a

Download Submit
C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-3AVBO.tmp

Filesize
132KB

MD5
96969eb9afc4355dd342e251734a557d

SHA1
796f619070b3d7cad99fb943aaa51228496042f0

SHA256
9abf2b43b4f6aed60b3231b8dad8a7c5d5b219591b511fd529d6c0736c24bffe

SHA512
6bfb730442ea67a51f989e67913e48758fc672cf6c36f09b9928c285ab87982e8cacc18412855520070710b3175822fc1a7378f2548ebb071893dbd40a3b74c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json

Filesize
2KB

MD5
b9458ee7df2e344cfb7ebca63abce667

SHA1
f14b31b480a196c1b072455a61ef4bd316c0deb9

SHA256
d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7

SHA512
af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28

Download Submit
C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json

Filesize
2KB

MD5
b9458ee7df2e344cfb7ebca63abce667

SHA1
f14b31b480a196c1b072455a61ef4bd316c0deb9

SHA256
d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7

SHA512
af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE052.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe

Filesize
120KB

MD5
d30d3a49fa8166b17dfdba3a9a153e92

SHA1
d97de62286b49e7fd25a8ef45d4808c7ebb320d4

SHA256
9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2

SHA512
466689b40679dd7c78d504bd440ad68e6656a8d4d88822f21c0deb513921ea0c578af63aeaf6c8b4f4edf989c36727575f3a69fd62f291d5bd5af3739733178b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe

Filesize
262.7MB

MD5
9bf2310d428ba023fec2ad87adef42d5

SHA1
4c94c0e7fb0ae4a0723f9265b97fc1225c2d69fb

SHA256
dec0d968446dfb35c39f272adc9d6b91aa79f68ed8a4934113f59b5c1a142abb

SHA512
418c16a05ce884d845090119bda65bf01f4dbd681dc3a538f6c27da8b251cf6344479ac6c69bd3e8fb6fe7dd4fa3b54deccd29701797d781b03ceb087c636366

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe

Filesize
262.7MB

MD5
9bf2310d428ba023fec2ad87adef42d5

SHA1
4c94c0e7fb0ae4a0723f9265b97fc1225c2d69fb

SHA256
dec0d968446dfb35c39f272adc9d6b91aa79f68ed8a4934113f59b5c1a142abb

SHA512
418c16a05ce884d845090119bda65bf01f4dbd681dc3a538f6c27da8b251cf6344479ac6c69bd3e8fb6fe7dd4fa3b54deccd29701797d781b03ceb087c636366

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxySetup.exe

Filesize
262.7MB

MD5
9bf2310d428ba023fec2ad87adef42d5

SHA1
4c94c0e7fb0ae4a0723f9265b97fc1225c2d69fb

SHA256
dec0d968446dfb35c39f272adc9d6b91aa79f68ed8a4934113f59b5c1a142abb

SHA512
418c16a05ce884d845090119bda65bf01f4dbd681dc3a538f6c27da8b251cf6344479ac6c69bd3e8fb6fe7dd4fa3b54deccd29701797d781b03ceb087c636366

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\icon.ico

Filesize
109KB

MD5
90ce8a437fcaf7c5af8b9e6f99a72247

SHA1
bd4b4d8a5ba983103fd5171061938a750a3bc22d

SHA256
cb78a6deee16650a3284322e2ed03a4528d2b2565683fc369b76355a4a0ef951

SHA512
8919ba6f57a95746710f8ddaa5ab1b5d27be0ac47504316ed84118896e03297fa0fefc5ccf091d94e97f6ab9666e9564831ae17bc47760df07ac702248a2f6d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\remoteconfig.json

Filesize
555B

MD5
51fe53e485f9767f8db9fcc2abf60d7e

SHA1
3255e1830c405b0df6057b89bd23583be55eed74

SHA256
d335bbe53c54b02d42a3ff4ea976bff6597fd70a2dfd53cc03f181ebab689fc4

SHA512
81f473f76d3941865bad44794c59644e33334ce487662e80fdc78959233f6abd7c2f359c9c61ac27ae8a4e8aeb59068ae9e817f7d0c2af016330e275b3b30e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\remoteconfig.json

Filesize
555B

MD5
51fe53e485f9767f8db9fcc2abf60d7e

SHA1
3255e1830c405b0df6057b89bd23583be55eed74

SHA256
d335bbe53c54b02d42a3ff4ea976bff6597fd70a2dfd53cc03f181ebab689fc4

SHA512
81f473f76d3941865bad44794c59644e33334ce487662e80fdc78959233f6abd7c2f359c9c61ac27ae8a4e8aeb59068ae9e817f7d0c2af016330e275b3b30e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe

Filesize
14.3MB

MD5
1e7bd6790391b5b710c6372ab2042351

SHA1
75f1aee6dccf3d6e6ac49926563737005b93ba13

SHA256
952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

SHA512
ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe

Filesize
14.3MB

MD5
1e7bd6790391b5b710c6372ab2042351

SHA1
75f1aee6dccf3d6e6ac49926563737005b93ba13

SHA256
952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

SHA512
ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe

Filesize
13.8MB

MD5
3aa2d769397da14166eacdb3640458ee

SHA1
b38b7fc28c5e2ef157f93297036202911d2fc2bf

SHA256
b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519

SHA512
404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe

Filesize
13.8MB

MD5
3aa2d769397da14166eacdb3640458ee

SHA1
b38b7fc28c5e2ef157f93297036202911d2fc2bf

SHA256
b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519

SHA512
404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U3HUD.tmp\GalaxySetup.tmp

Filesize
3.3MB

MD5
d4d2a2f5b5fff481cac8d7b11578fab5

SHA1
210d87bdcf3bb9860c513a856b0c395288111255

SHA256
92826c668ebc5ef58fbb1a57a1b88fef61c0070edbb0bae25bdef65091680571

SHA512
8b262ab93c6018fdb59c37eca0168b13507c349814d536b752b3227bb071f93fa1f80e1318187dce30d01be8514d253e7c6deb050f9d4a484dba20a7f5d8988e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U3HUD.tmp\GalaxySetup.tmp

Filesize
3.3MB

MD5
d4d2a2f5b5fff481cac8d7b11578fab5

SHA1
210d87bdcf3bb9860c513a856b0c395288111255

SHA256
92826c668ebc5ef58fbb1a57a1b88fef61c0070edbb0bae25bdef65091680571

SHA512
8b262ab93c6018fdb59c37eca0168b13507c349814d536b752b3227bb071f93fa1f80e1318187dce30d01be8514d253e7c6deb050f9d4a484dba20a7f5d8988e

Download Submit
C:\Windows\Temp\{340A7C6B-05B0-4651-8712-FCEFA241FF89}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{41EC46B8-B905-4241-BE4E-1356F2C9D8EF}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{4F02EB64-3D9E-4770-B829-9312D78952C8}\.cr\VC_redist.x64.exe

Filesize
632KB

MD5
1d7599c4a31b82e70308c022e9494011

SHA1
7d04a03d5502df2838d40dd131b1cae226cb5205

SHA256
21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

SHA512
080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

Download Submit
C:\Windows\Temp\{4F02EB64-3D9E-4770-B829-9312D78952C8}\.cr\VC_redist.x64.exe

Filesize
632KB

MD5
1d7599c4a31b82e70308c022e9494011

SHA1
7d04a03d5502df2838d40dd131b1cae226cb5205

SHA256
21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

SHA512
080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

Download Submit
C:\Windows\Temp\{E96E481C-EB83-44F7-A762-E66D5BFD7E4D}\.cr\VC_redist.x86.exe

Filesize
632KB

MD5
68f7654abfd77baade7a36e1d718ebc4

SHA1
eabba5cb899aee962f85b52e359c9f85d83771b6

SHA256
5b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb

SHA512
b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889

Download Submit
C:\Windows\Temp\{E96E481C-EB83-44F7-A762-E66D5BFD7E4D}\.cr\VC_redist.x86.exe

Filesize
632KB

MD5
68f7654abfd77baade7a36e1d718ebc4

SHA1
eabba5cb899aee962f85b52e359c9f85d83771b6

SHA256
5b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb

SHA512
b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889

Download Submit
\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

Filesize
13.2MB

MD5
0658a4d0c13dcfab4dbde805f6e6860e

SHA1
6b2579402e748c7ca1efe1f9bb1829b935e2e7a3

SHA256
128fbd3e7bc974a324006f8a3b698c304de9b68acac4def6068bee651b4ea97b

SHA512
eae31bf35bc820d6f153e01934e456224f1de37f591cb71cd31fdb745e7fad28d6434a0c9166a0d94cb44778b1053a02e63d68f64552587ad7bfeb8caa11c274

Download Submit
\Program Files (x86)\GOG Galaxy\PocoData.dll

Filesize
1.7MB

MD5
7818a804fa9fd0f9a09263b6b35325fc

SHA1
590971157aa72d48f7939556a7554bc9d8975cd5

SHA256
f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416

SHA512
63a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561

Download Submit
\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll

Filesize
372KB

MD5
dd7065f6e3bd80c6e7e6419e2475c8a8

SHA1
f01ce83abf97c075fdad042cf6e3f994110ceb78

SHA256
0c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c

SHA512
00656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5

Download Submit
\Program Files (x86)\GOG Galaxy\PocoFoundation.dll

Filesize
1.7MB

MD5
3e72226a19d731e0d0baa1e9a2017dd7

SHA1
d1ea639b8a0532f9ce092861016f79d672dcef25

SHA256
97190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8

SHA512
eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541

Download Submit
\Program Files (x86)\GOG Galaxy\PocoJSON.dll

Filesize
338KB

MD5
c645048dcbff4fd35d51a254c18dc131

SHA1
a3c9b97073d69318979a4d1bb66f02edc7ccdd88

SHA256
ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53

SHA512
421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca

Download Submit
\Program Files (x86)\GOG Galaxy\PocoNet.dll

Filesize
1.3MB

MD5
8fbf4845c06da70e17e40376244b97ba

SHA1
488bb2cfc96dbe103425b9657ddfd646aae4388c

SHA256
fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b

SHA512
c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1

Download Submit
\Program Files (x86)\GOG Galaxy\PocoUtil.dll

Filesize
526KB

MD5
9cb7c18b68e61c0eac049a3d7d0b970c

SHA1
83f17545fc35c2e1a0b627236309d8c0933a67d3

SHA256
0d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609

SHA512
9bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4

Download Submit
\Program Files (x86)\GOG Galaxy\PocoXml.dll

Filesize
539KB

MD5
ed29d945a6e4ab83974d783e5a910d20

SHA1
4a008b7dcd527fd2ad6b0e4211f431a983104605

SHA256
c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e

SHA512
8d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f

Download Submit
\Program Files (x86)\GOG Galaxy\Qt5Core.dll

Filesize
5.1MB

MD5
ecd2fed8765416bf429f32f14cc5c747

SHA1
00f09763508c58be76a0ef0b348358a0802d4745

SHA256
e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8

SHA512
77d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057

Download Submit
\Program Files (x86)\GOG Galaxy\Qt5Gui.dll

Filesize
5.6MB

MD5
68c19f9f45a98734a6e42745a75ff2d3

SHA1
1f39560b10ab2bf6f3fab76a3be5f305b169fcaa

SHA256
1233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329

SHA512
df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41

Download Submit
\Program Files (x86)\GOG Galaxy\Qt5Network.dll

Filesize
1.0MB

MD5
9dcd0f88d822d9e8f5d72dc15f53fb71

SHA1
5e06d4ec06f720a06320bf660fe5f34a460af200

SHA256
99dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5

SHA512
cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a

Download Submit
\Program Files (x86)\GOG Galaxy\libexpat.dll

Filesize
173KB

MD5
657d32eec34d3225b38262a5878e9474

SHA1
22daaca36c1d49bdb8b2851f40596d4cd025dcb0

SHA256
ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62

SHA512
d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895

Download Submit
\Program Files (x86)\GOG Galaxy\pcre2-8.dll

Filesize
576KB

MD5
6ff65827e6191c4aebe6d611341ae02e

SHA1
41ecaa87dcc727340e6358251a08d3bab240b58e

SHA256
a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544

SHA512
85d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33

Download Submit
\Program Files (x86)\GOG Galaxy\sqlite.dll

Filesize
802KB

MD5
570163e4b53390b17bf78af85e8af01d

SHA1
e642d74d485c4a3ed3a339ff3f2497b06033ccf2

SHA256
dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a

SHA512
6ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc

Download Submit
\Program Files (x86)\GOG Galaxy\xdelta3.dll

Filesize
131KB

MD5
9cfacd6bb21d545f154a3ec82aaf9d93

SHA1
1bbee4abe68031b38256c0f4584adb6aed95ce7b

SHA256
57f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953

SHA512
71f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a

Download Submit
\Program Files (x86)\GOG Galaxy\zlib1.dll

Filesize
104KB

MD5
2a92f0dc6dac8545718ee475b7b961ed

SHA1
c154cdcf10e411f1622e29a7f019ae610f35ddf1

SHA256
3c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890

SHA512
190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234

Download Submit
\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe

Filesize
120KB

MD5
d30d3a49fa8166b17dfdba3a9a153e92

SHA1
d97de62286b49e7fd25a8ef45d4808c7ebb320d4

SHA256
9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2

SHA512
466689b40679dd7c78d504bd440ad68e6656a8d4d88822f21c0deb513921ea0c578af63aeaf6c8b4f4edf989c36727575f3a69fd62f291d5bd5af3739733178b

Download Submit
\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe

Filesize
120KB

MD5
d30d3a49fa8166b17dfdba3a9a153e92

SHA1
d97de62286b49e7fd25a8ef45d4808c7ebb320d4

SHA256
9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2

SHA512
466689b40679dd7c78d504bd440ad68e6656a8d4d88822f21c0deb513921ea0c578af63aeaf6c8b4f4edf989c36727575f3a69fd62f291d5bd5af3739733178b

Download Submit
\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe

Filesize
120KB

MD5
d30d3a49fa8166b17dfdba3a9a153e92

SHA1
d97de62286b49e7fd25a8ef45d4808c7ebb320d4

SHA256
9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2

SHA512
466689b40679dd7c78d504bd440ad68e6656a8d4d88822f21c0deb513921ea0c578af63aeaf6c8b4f4edf989c36727575f3a69fd62f291d5bd5af3739733178b

Download Submit
\Users\Admin\AppData\Local\Temp\GalaxyInstaller_cNlTr\GalaxyInstaller.exe

Filesize
120KB

MD5
d30d3a49fa8166b17dfdba3a9a153e92

SHA1
d97de62286b49e7fd25a8ef45d4808c7ebb320d4

SHA256
9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2

SHA512
466689b40679dd7c78d504bd440ad68e6656a8d4d88822f21c0deb513921ea0c578af63aeaf6c8b4f4edf989c36727575f3a69fd62f291d5bd5af3739733178b

Download Submit
\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x64.exe

Filesize
14.3MB

MD5
1e7bd6790391b5b710c6372ab2042351

SHA1
75f1aee6dccf3d6e6ac49926563737005b93ba13

SHA256
952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

SHA512
ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

Download Submit
\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\VC_redist.x86.exe

Filesize
13.8MB

MD5
3aa2d769397da14166eacdb3640458ee

SHA1
b38b7fc28c5e2ef157f93297036202911d2fc2bf

SHA256
b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519

SHA512
404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56

Download Submit
\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
\Users\Admin\AppData\Local\Temp\is-R72VP.tmp\botva2.dll

Filesize
32KB

MD5
295832fa6400cb3407cfe84b06785531

SHA1
7068910c2e0ea7f4535c770517e29d9c2d2ee77b

SHA256
13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

SHA512
50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

Download Submit
\Users\Admin\AppData\Local\Temp\is-U3HUD.tmp\GalaxySetup.tmp

Filesize
3.3MB

MD5
d4d2a2f5b5fff481cac8d7b11578fab5

SHA1
210d87bdcf3bb9860c513a856b0c395288111255

SHA256
92826c668ebc5ef58fbb1a57a1b88fef61c0070edbb0bae25bdef65091680571

SHA512
8b262ab93c6018fdb59c37eca0168b13507c349814d536b752b3227bb071f93fa1f80e1318187dce30d01be8514d253e7c6deb050f9d4a484dba20a7f5d8988e

Download Submit
\Windows\Temp\{340A7C6B-05B0-4651-8712-FCEFA241FF89}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{41EC46B8-B905-4241-BE4E-1356F2C9D8EF}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
\Windows\Temp\{4F02EB64-3D9E-4770-B829-9312D78952C8}\.cr\VC_redist.x64.exe

Filesize
632KB

MD5
1d7599c4a31b82e70308c022e9494011

SHA1
7d04a03d5502df2838d40dd131b1cae226cb5205

SHA256
21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

SHA512
080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

Download Submit
\Windows\Temp\{E96E481C-EB83-44F7-A762-E66D5BFD7E4D}\.cr\VC_redist.x86.exe

Filesize
632KB

MD5
68f7654abfd77baade7a36e1d718ebc4

SHA1
eabba5cb899aee962f85b52e359c9f85d83771b6

SHA256
5b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb

SHA512
b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889

Download Submit
memory/732-98-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/732-97-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/732-79-0x0000000000250000-0x0000000000270000-memory.dmp

Filesize
128KB

Download
memory/732-80-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/732-95-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/1432-54-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1432-81-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/1616-333-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-177-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1616-137-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-124-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1616-138-0x0000000003460000-0x000000000346D000-memory.dmp

Filesize
52KB

Download
memory/1616-131-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-2076-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-1436-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-2461-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-207-0x0000000000400000-0x0000000000765000-memory.dmp

Filesize
3.4MB

Download
memory/1616-134-0x0000000003460000-0x000000000346D000-memory.dmp

Filesize
52KB

Download
memory/1932-2463-0x00000000011D0000-0x00000000011E0000-memory.dmp

Filesize
64KB

Download
memory/2016-118-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/2016-130-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/2016-114-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/2784-2623-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download