Analysis

  • max time kernel
    127s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 00:07

General

  • Target

    GOG_Galaxy_2.0.exe

  • Size

    960KB

  • MD5

    073c6e12924e8ed40908ebd8f50269f6

  • SHA1

    55531db348c074a2bea5a78ac79f0193e5281a35

  • SHA256

    35d28d41f6ae7bee08889ae3f470af4f94eaf52fa55ab3c1661ae9419947d8c1

  • SHA512

    c5dba4fe0f655f961a4198b6eeb96face546585a1b78210149a952bbbe9793fa8db9efefd522681200dd693c5e9fa81ddbdf0bcf0e525a82ad10fd72ba741686

  • SSDEEP

    12288:T27p5j8DPeuUSFHqLV+JjY4UW61O4RAxDleFbWQCQTFgSYyAzB+Q/uLnK3:T27EDFHqLy826My+QiyGJyAV+muLK3

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxyInstaller.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Users\Admin\AppData\Local\Temp\is-3LCG4.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-3LCG4.tmp\GalaxySetup.tmp" /SL5="$80060,273144529,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1548
          • C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Windows\Temp\{ACBB58C6-23D1-4791-BBFF-37BA16B735E0}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{ACBB58C6-23D1-4791-BBFF-37BA16B735E0}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2536
          • C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1656
            • C:\Windows\Temp\{01FABDE2-65D9-4508-A278-E27E59F0D7D2}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{01FABDE2-65D9-4508-A278-E27E59F0D7D2}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4292
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault /payload=eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3276
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1984
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /installerLaunch /payload=eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:316
            • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
              "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=13228192529590573529 --mojo-platform-channel-handle=3580 /prefetch:2
              6⤵
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              PID:3332
            • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
              "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=13684168017683125576 --renderer-client-id=3 --mojo-platform-channel-handle=4356 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4144
            • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
              "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=12969410558164474444 --mojo-platform-channel-handle=2368 /prefetch:2
              6⤵
              • Executes dropped EXE
              PID:1088
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:216
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2184
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe

    Filesize

    13.3MB

    MD5

    16bdc3ec70e6266438a673dd37197446

    SHA1

    963fb9a1c5f91cb7460225074a27fa590bdf925e

    SHA256

    6d85e3478854ec9a8690e61a178e2638b210506222eb6cd9b1e8e22a3a711c90

    SHA512

    018d9c4eeaed14699207377ee32d62bc95e8cab3656f01c1143c392fbac8402419c2d0d30a230a4dc27e7ec7b511b0821a36f84410380358124a159fe984b94a

  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe

    Filesize

    2.2MB

    MD5

    f11aa32e673a5fe205804fc8f27dd15d

    SHA1

    2f3e7bf477a8ee79ff8b67bbbe85079c4a00dfc9

    SHA256

    08700a4c80042ea8690d2623fde9e808f913b2a201307802f3a893b892ef70df

    SHA512

    b3e66a53b05b3e8ca1aa01905b0f24a2e98933bab9ae507eb5b8a4d475ee25c683d8d9df1c1d484500bec78ef915715e463ecb849304bd0d5ba90ad3693e9660

  • C:\Program Files (x86)\GOG Galaxy\PocoData.dll

    Filesize

    1.7MB

    MD5

    7818a804fa9fd0f9a09263b6b35325fc

    SHA1

    590971157aa72d48f7939556a7554bc9d8975cd5

    SHA256

    f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416

    SHA512

    63a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561

  • C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll

    Filesize

    372KB

    MD5

    dd7065f6e3bd80c6e7e6419e2475c8a8

    SHA1

    f01ce83abf97c075fdad042cf6e3f994110ceb78

    SHA256

    0c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c

    SHA512

    00656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5

  • C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll

    Filesize

    1.7MB

    MD5

    3e72226a19d731e0d0baa1e9a2017dd7

    SHA1

    d1ea639b8a0532f9ce092861016f79d672dcef25

    SHA256

    97190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8

    SHA512

    eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541

  • C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll

    Filesize

    338KB

    MD5

    c645048dcbff4fd35d51a254c18dc131

    SHA1

    a3c9b97073d69318979a4d1bb66f02edc7ccdd88

    SHA256

    ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53

    SHA512

    421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca

  • C:\Program Files (x86)\GOG Galaxy\PocoNet.dll

    Filesize

    1.3MB

    MD5

    8fbf4845c06da70e17e40376244b97ba

    SHA1

    488bb2cfc96dbe103425b9657ddfd646aae4388c

    SHA256

    fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b

    SHA512

    c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1

  • C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll

    Filesize

    526KB

    MD5

    9cb7c18b68e61c0eac049a3d7d0b970c

    SHA1

    83f17545fc35c2e1a0b627236309d8c0933a67d3

    SHA256

    0d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609

    SHA512

    9bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4

  • C:\Program Files (x86)\GOG Galaxy\PocoXml.dll

    Filesize

    539KB

    MD5

    ed29d945a6e4ab83974d783e5a910d20

    SHA1

    4a008b7dcd527fd2ad6b0e4211f431a983104605

    SHA256

    c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e

    SHA512

    8d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f

  • C:\Program Files (x86)\GOG Galaxy\PocoZip.dll

    Filesize

    287KB

    MD5

    fe8390a1579b4d0ac0f168bc59a70ae0

    SHA1

    927f98a0c58e96de4886bb5253b538627de9e823

    SHA256

    feb6006bd1fa6224313fc02d70c38da1c95827152452370c8aa2087e122b02ce

    SHA512

    d924a509933dcfe97b79ef4f715107c55f931058391f7a782cf496a84dfe42656e5f7a523dbbc7b21cf51cbea8aa02b43a5392e2b0e6a4f06a97d504eebb1f7d

  • C:\Program Files (x86)\GOG Galaxy\Qt5Core.dll

    Filesize

    5.1MB

    MD5

    ecd2fed8765416bf429f32f14cc5c747

    SHA1

    00f09763508c58be76a0ef0b348358a0802d4745

    SHA256

    e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8

    SHA512

    77d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057

  • C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll

    Filesize

    5.6MB

    MD5

    68c19f9f45a98734a6e42745a75ff2d3

    SHA1

    1f39560b10ab2bf6f3fab76a3be5f305b169fcaa

    SHA256

    1233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329

    SHA512

    df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41

  • C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll

    Filesize

    1.0MB

    MD5

    9dcd0f88d822d9e8f5d72dc15f53fb71

    SHA1

    5e06d4ec06f720a06320bf660fe5f34a460af200

    SHA256

    99dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5

    SHA512

    cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a

  • C:\Program Files (x86)\GOG Galaxy\chrome_elf.dll

    Filesize

    703KB

    MD5

    884537665618e90e195912a01fc0b007

    SHA1

    0dfb2689ed2b37260392776a6aa4025b31c5025f

    SHA256

    98a132ff75b044ce9a666148cce3742214a8525f3c839f4c2a47356aeb93e652

    SHA512

    02eb60c9e42d1477aa5c27e0c38af1757b09738c2e287964fa5aa510547abf0cef6050f9ae64442250634a8fd21ad345c3fd3432466cecffad384805ed3d6461

  • C:\Program Files (x86)\GOG Galaxy\libcrypto-1_1.dll

    Filesize

    2.4MB

    MD5

    e863188d86f3291d101d3165a57f42c1

    SHA1

    d22b38ef7fb33203506a997114ec1bbf54df8a35

    SHA256

    ef31c88b93350311ec3b55d8a6a1279bf919196ae268254a51e698a049045321

    SHA512

    18d84e4ab9012d20b041cb4409486c41267e141196c4bc249bb7b1f3b5ca6c4641f4664a510c81d2f4ffcaac3af149035f2ec1699ffbe61a15ab7b7d651d39e5

  • C:\Program Files (x86)\GOG Galaxy\libexpat.dll

    Filesize

    173KB

    MD5

    657d32eec34d3225b38262a5878e9474

    SHA1

    22daaca36c1d49bdb8b2851f40596d4cd025dcb0

    SHA256

    ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62

    SHA512

    d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895

  • C:\Program Files (x86)\GOG Galaxy\pcre2-8.dll

    Filesize

    576KB

    MD5

    6ff65827e6191c4aebe6d611341ae02e

    SHA1

    41ecaa87dcc727340e6358251a08d3bab240b58e

    SHA256

    a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544

    SHA512

    85d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33

  • C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-Q958A.tmp

    Filesize

    987KB

    MD5

    562e8efa4422fdab66fd48ae64dfc7a5

    SHA1

    22d7f566adfd42c6c18c5a2e2ccd5d5a3bd49706

    SHA256

    73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303

    SHA512

    b513c177f8dc6edd26391af045bbbd57fc31c3346cc78ae1083373247e08405416198682e773a33991b6f311cd4f65fd2656cb55c63668499494eb7454852f0a

  • C:\Program Files (x86)\GOG Galaxy\sqlite.dll

    Filesize

    802KB

    MD5

    570163e4b53390b17bf78af85e8af01d

    SHA1

    e642d74d485c4a3ed3a339ff3f2497b06033ccf2

    SHA256

    dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a

    SHA512

    6ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc

  • C:\Program Files (x86)\GOG Galaxy\web\is-5BHE8.tmp

    Filesize

    27KB

    MD5

    240a27d574f21e6dbe82ccfed9d11916

    SHA1

    bc22e5eb3e1b8c330b667d956118ac3ef1472923

    SHA256

    e5434b7722d33b1dd24a53bca66e7a746739f5801956fb1ce1ace7b2a1771327

    SHA512

    071fc1843a8911da9d6d354cec06605feb6a56eb7627f69e2338a57ea7fc3522caf0549c284a8b7f68f18fa284bc3bc51f13dcf6d192b1738d07dcc042b5d8c4

  • C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-OPD3C.tmp

    Filesize

    1KB

    MD5

    bf804964f529597485b5aa66f76656d8

    SHA1

    1625addc939cf41ad6677ed2330da32d656d3496

    SHA256

    4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0

    SHA512

    6c9009c448830cd678be6d6edc28ee5e936ce25ff100c93df66ad24a8f93fc21739ffe80e27d94f400736cf76ae7735ddb7568ffa68ae23a0f566396eb6c4413

  • C:\Program Files (x86)\GOG Galaxy\xdelta3.dll

    Filesize

    131KB

    MD5

    9cfacd6bb21d545f154a3ec82aaf9d93

    SHA1

    1bbee4abe68031b38256c0f4584adb6aed95ce7b

    SHA256

    57f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953

    SHA512

    71f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a

  • C:\Program Files (x86)\GOG Galaxy\zlib1.dll

    Filesize

    104KB

    MD5

    2a92f0dc6dac8545718ee475b7b961ed

    SHA1

    c154cdcf10e411f1622e29a7f019ae610f35ddf1

    SHA256

    3c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890

    SHA512

    190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234

  • C:\ProgramData\GOG.com\Galaxy\changelogs\is-H9A0R.tmp

    Filesize

    40KB

    MD5

    0b0e0cddd17466c1e3b81e608e29efc3

    SHA1

    30120f882defb836ee1cee65eae9bb3771a259b5

    SHA256

    91a6099a4e818b25085359ab1e6bbb0773503ab0e5cdac21bac0f6720ff21e12

    SHA512

    362d42f2e974b7536dc154bf4c5057ff737b2ea940e87b00a8b4183542b7ef6f5ab32840b2401523ba5e230509e865c95e65dc0bb0adba97b9433e624f5962dd

  • C:\ProgramData\GOG.com\Galaxy\config.json

    Filesize

    268B

    MD5

    0983ab2871e1f03d0d78954b0e78ded8

    SHA1

    c15910cdc2a98840d4731cb477d497dfea23387c

    SHA256

    375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093

    SHA512

    87a497a9f216fd7dddaa2ef7e0a9ed930ca5634811de5da124b4444b9aea9e755b434770cd6a1921b5f3b7e10fbafab0f442946122765b016f0a28e38e623f3a

  • C:\ProgramData\GOG.com\Galaxy\config.json

    Filesize

    333B

    MD5

    e823d5a016a25d58c4049f9389624685

    SHA1

    83845b03459ed820e5fa862f8a4c38dca34d58ec

    SHA256

    f622cfbd3bb53cf4cecc8a29685ee8a4e839548e102e79f97474e83eae2ad894

    SHA512

    d84f44365f379ec5c69be2025cd226bce995f5731ce3b114bd3b240a287a042e1658cafd8e2edeafe3e164a9610d8ee3d8143e403e58ed26b79f11cc04593f3f

  • C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log

    Filesize

    696B

    MD5

    2bdf4a49716a88a2b28c615b77be32b3

    SHA1

    ff6198c684338ec3c9d6b376ec3bc2fa47fa4010

    SHA256

    171d2cfde70003a04429a70ad48978296bcae0dd9ef196dba4b2d12250ee503e

    SHA512

    118544fe26f82bb44310472eeab65bbe5686adf905067b305529a7240e69e7cecbaa665a74d90dd2c3c3146687ccd02ac5a78a7c5e6bfc80bc8cc237bbcdd7ac

  • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe

    Filesize

    6.8MB

    MD5

    880582f1109fcd85a0a37cee73c341d4

    SHA1

    aab9767740e4c5597b91332f1d680b3306ef9a97

    SHA256

    e4724a1452c799f13e307202383e013302b35e755bc7af267ba3386bee0fd415

    SHA512

    6d7c1c1884e5b2e71720ba05825f98f2204ae64296819f160db347caf20ad40c7abdcd71f025b3226a28e9f26d403fc8d3d37440c501da43a8889fc111904c4a

  • C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-FTI42.tmp

    Filesize

    135KB

    MD5

    35a480f9b79fefcc52fbeb9f407b9ddb

    SHA1

    71b93366f61ab551728b19839e88307b5ad5660d

    SHA256

    696168032cb8e76bfeb70892bb7a027e66d9284dd5ee839852f964eed0e5441d

    SHA512

    2a0972476ee922e80a5303ecec277d57fde355beb2fa6313d4304e63448f9acc46cb36782983e67875fb8bcb1c211ddfa6bc104ee7101d9546ba5d95589d7f0e

  • C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\f_000005

    Filesize

    207KB

    MD5

    5a641d4af4cd4ebc751c4d0ff5390451

    SHA1

    0b6d6c07151f9e93e107d97173ea5de6d21c6ff3

    SHA256

    0e16584de89206c4e127988def8ea28d70bb0ef2dc8c914a2d8dc65a83fd2115

    SHA512

    4a0c770313c8206e9c878c24e7462cd5ea7af76d418261b503abc576378f59a6963a90a588e0f7ed2aaafbb14daf2d6316b5148998d2fa84c1ac4f58189205fa

  • C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\temp-index

    Filesize

    216B

    MD5

    27a84a27f209f48a479209da0d5e0521

    SHA1

    3cdf3d98ce2a2690a55e1a1424e09a8fdcd83bad

    SHA256

    fff7e156b1bae681103ee779afb58cd0d508cf549b137b1c54d0e695ef1c0a13

    SHA512

    e84a529bf34cc32157775fc31834c9dff333578f11f158d7362f282c478e20b5ccd37e9f16cf73412c2274ceefd73b7bd7d98abc8a564dde49d92e4d7e5a2fe0

  • C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\the-real-index~RFe598776.TMP

    Filesize

    48B

    MD5

    d5860b96f38104106e637476487cde33

    SHA1

    b14e56b1431fd2fd6eb2a1a00e8003b779b16e6c

    SHA256

    f640237ebb02a96f35f4a685ecbf6bddfd43f4eb69f738006551ccb36b284de6

    SHA512

    2041c1cb09c989dbf5f71467e20ff85d54953c71b7416a92ecb7191d62ceabb0d8f2a2328eeafeeb579235a08833837abfc165fd4bf2dfdb104acae6de46fab2

  • C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\MANIFEST-000001

    Filesize

    41B

    MD5

    5af87dfd673ba2115e2fcf5cfdb727ab

    SHA1

    d5b5bbf396dc291274584ef71f444f420b6056f1

    SHA256

    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

    SHA512

    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

  • C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json

    Filesize

    2KB

    MD5

    b9458ee7df2e344cfb7ebca63abce667

    SHA1

    f14b31b480a196c1b072455a61ef4bd316c0deb9

    SHA256

    d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7

    SHA512

    af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28

  • C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json

    Filesize

    2KB

    MD5

    1c07a849d7dabee5460ca861a578a795

    SHA1

    05cf925ef2c58211a87c2d2c56cbc909de4249ad

    SHA256

    dc1ff826c6b7f3bb7486246067a205f5c58274f8e88801d1d5a3ca74f4efaf25

    SHA512

    0d8aded38d84eb65026f3a3f3860551d05b3594e0fa7e6a2728ad1cf6d59f5a83c9d7a73c806d9e3f1326760fe1ba2a86223cde7695c93175aa1f62eecc84595

  • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxyInstaller.exe

    Filesize

    566KB

    MD5

    26d02cc778b804689bda1aafa9a76fb1

    SHA1

    5452c96593478f59471730366c682da19881051d

    SHA256

    61eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635

    SHA512

    047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90

  • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\icon.ico

    Filesize

    480KB

    MD5

    391cf634b3ccf3971811be5ef016fe32

    SHA1

    8e3023466d02dfb8f2e1b48555b998532dc9a377

    SHA256

    de9a2072df66c11af8cc255788c4c572f7b45ba7ab19524ad2e01a23f55e9ca8

    SHA512

    c1594a33efcfac7c6e6935e76ed030855886453b6397ba53a63225efbeb513a1ccb39ea7d528cc43bb1e2b56fd0e02b306e0e65dc6896613c2b4ca6c4a165d9a

  • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\payload.campaign

    Filesize

    555B

    MD5

    7b11a2b50548f6e537f62063817c65f8

    SHA1

    891b24b24eb7fd5a95e765015763beee27385790

    SHA256

    891320597758a78ffc1d89c67cbd0b570aa94c32047e6f3ac9121e0d180c1aa9

    SHA512

    0e93582ec31dff7ed66e5498656a80d245cf34b1ce556864222d7505d9a531cedb9e91590c880a5852cd3a8c351847019d0e69b02240feb4dc257374ecf587e2

  • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\remoteconfig.json

    Filesize

    561B

    MD5

    068a761b1ea67b67ac574d7a79180949

    SHA1

    af2d474fe6ddec279f7f4453b3e532279a7d250a

    SHA256

    a08b8fdc1bb517a3e29c29fac6af7636e475e3e27d66384c4b63bcb326b43b5a

    SHA512

    88e50fa96b4845f193a6954ee72fcf4ba4f9071dddcdea713f33c0a1381ff7d59fdd706253a3e682f16d10bb90ccae8f3ec24316ca84933b880ccbe75d5e506b

  • C:\Users\Admin\AppData\Local\Temp\is-3LCG4.tmp\GalaxySetup.tmp

    Filesize

    3.3MB

    MD5

    300342bd92d7c94783a75aef90780d83

    SHA1

    6c061285e94addf89329f9f2b4c4022eb21a6dde

    SHA256

    a652e160d8d0bf4c4e2585506635c25425a508d2430fd00e1aa913111ad0dba9

    SHA512

    4f5f63f42033f83e02338372a216c0b6f3233defe7b91488d0c850f72090a85d7c575092cb77a0639b423236831092447d388f51b076a7649b862c2b021f372d

  • C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe

    Filesize

    14.3MB

    MD5

    1e7bd6790391b5b710c6372ab2042351

    SHA1

    75f1aee6dccf3d6e6ac49926563737005b93ba13

    SHA256

    952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

    SHA512

    ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

  • C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe

    Filesize

    13.8MB

    MD5

    3aa2d769397da14166eacdb3640458ee

    SHA1

    b38b7fc28c5e2ef157f93297036202911d2fc2bf

    SHA256

    b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519

    SHA512

    404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56

  • C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\_isetup\_isdecmp.dll

    Filesize

    28KB

    MD5

    077cb4461a2767383b317eb0c50f5f13

    SHA1

    584e64f1d162398b7f377ce55a6b5740379c4282

    SHA256

    8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

    SHA512

    b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3b94415067dd2c5d.customDestinations-ms

    Filesize

    5KB

    MD5

    96dd80972b008f7531b1c14b52c49559

    SHA1

    862d800319898af13cde9523456eefeece311127

    SHA256

    9d3761eb7baf7b6f5eb3153abe366fba17cebc172ab65a2915fed7039daca835

    SHA512

    349c577d98ba5c30edf0d8581e32638f4c40aeced6ab53848a5091d38a11c98c372eef7b24790c796fc440c95ab7ff895464e5199cf9f559b51e43ee64cee7f2

  • C:\Windows\Temp\{01FABDE2-65D9-4508-A278-E27E59F0D7D2}\.cr\VC_redist.x64.exe

    Filesize

    632KB

    MD5

    1d7599c4a31b82e70308c022e9494011

    SHA1

    7d04a03d5502df2838d40dd131b1cae226cb5205

    SHA256

    21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

    SHA512

    080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

  • C:\Windows\Temp\{472155DB-2C8B-4630-9A98-98FAE22EDA50}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{472155DB-2C8B-4630-9A98-98FAE22EDA50}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • C:\Windows\Temp\{ACBB58C6-23D1-4791-BBFF-37BA16B735E0}\.cr\VC_redist.x86.exe

    Filesize

    632KB

    MD5

    68f7654abfd77baade7a36e1d718ebc4

    SHA1

    eabba5cb899aee962f85b52e359c9f85d83771b6

    SHA256

    5b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb

    SHA512

    b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889

  • memory/1548-1281-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/1548-73-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/1548-2616-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/1548-2610-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/1548-2598-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/1548-79-0x0000000000400000-0x0000000000765000-memory.dmp

    Filesize

    3.4MB

  • memory/3516-36-0x00007FFCB6D23000-0x00007FFCB6D25000-memory.dmp

    Filesize

    8KB

  • memory/3516-2624-0x00007FFCB6D20000-0x00007FFCB77E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-76-0x00007FFCB6D20000-0x00007FFCB77E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-16-0x0000000000040000-0x00000000000D0000-memory.dmp

    Filesize

    576KB

  • memory/3516-17-0x00007FFCB6D20000-0x00007FFCB77E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-37-0x00007FFCB6D20000-0x00007FFCB77E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-42-0x00007FFCB6D20000-0x00007FFCB77E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-15-0x00007FFCB6D23000-0x00007FFCB6D25000-memory.dmp

    Filesize

    8KB

  • memory/3516-30-0x000000001D760000-0x000000001DC88000-memory.dmp

    Filesize

    5.2MB

  • memory/3516-29-0x000000001D060000-0x000000001D222000-memory.dmp

    Filesize

    1.8MB

  • memory/4588-71-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/4588-56-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/4588-2617-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/4732-34-0x0000000000400000-0x0000000000641000-memory.dmp

    Filesize

    2.3MB

  • memory/4732-2627-0x0000000000400000-0x0000000000641000-memory.dmp

    Filesize

    2.3MB

  • memory/4732-0-0x0000000000400000-0x0000000000641000-memory.dmp

    Filesize

    2.3MB