Overview

overview

9

Static

static

3

2026-06-26...os.exe

windows10-2004-x64

8

2026-06-26...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_32facbb2e082f7ebb779d481e5f1582f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1003KB
  • Sample260629-vlhq1sat21
  • SHA256 43e97e5716879aa06c97c6ab713ad296f572d5172e0574c31fb0ba4186752634
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_32facbb2e082f7ebb779d481e5f1582f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_32facbb2e082f7ebb779d481e5f1582f_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxyInstaller.exe" 1207662433 "Ultima IV™"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5820
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207662433 /silent /game_name="Ultima IV™"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Users\Admin\AppData\Local\Temp\is-3ON85.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-3ON85.tmp\GalaxySetup.tmp" /SL5="$702C2,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207662433 /silent /game_name="Ultima IV™"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4688
            • C:\Windows\Temp\{5CB239A9-6CBA-45AE-9C23-03C365BEC1FF}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{5CB239A9-6CBA-45AE-9C23-03C365BEC1FF}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=700 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{AA129CCA-D5DF-41AF-A59C-5645E125CB97} {FB4FCEB5-0225-42BE-B883-9BA8A90E2214} 2132
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:4524
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 912
                7⤵
                • Program crash
                PID:5696
          • C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2916
            • C:\Windows\Temp\{0FB888AD-18AF-469D-B37B-A507A50117E7}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{0FB888AD-18AF-469D-B37B-A507A50117E7}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2052
              • C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0C92DCCB-D77C-4579-9FE7-65DE937FFE4C} {98508369-1B3C-43D2-8358-35AFFA4DFEFE} 2052
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:5380
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1048
                7⤵
                • Program crash
                PID:4352
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:108
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4956
    • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1207662433
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3760,5764329581058098802,959575130218717394,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=9917454743989192006 --mojo-platform-channel-handle=3780 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:2108
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3760,5764329581058098802,959575130218717394,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2674862579772616444 --renderer-client-id=3 --mojo-platform-channel-handle=4540 /prefetch:1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1308
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3760,5764329581058098802,959575130218717394,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=460874211034862854 --mojo-platform-channel-handle=1796 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5976
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2364
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3156
  • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6060
    • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260629180524.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260629180524.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0568CD2A-ABD0-4316-BC5F-7B260FD35BF9} {E0192AC6-C15F-4962-A27A-CCC91771BD9F} 3000
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:2564
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1544
          4⤵
          • Program crash
          PID:1476
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2132 -ip 2132
    1⤵
      PID:1444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2052 -ip 2052
      1⤵
        PID:1316
      • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6064
        • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629180529.log" /install
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629180529.log" /install
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5551968C-0C50-437A-9A22-1D5C76CA7194} {71A6C480-BF12-4947-B6E8-19F19EC56266} 3192
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5884
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{306CB737-2570-411D-818E-B91CAEA95BAA} {8777039D-A6BC-486A-9A4C-ED76193B1B7D} 5884
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1816
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=504 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1124 -burn.embedded BurnPipe.{306CB737-2570-411D-818E-B91CAEA95BAA} {8777039D-A6BC-486A-9A4C-ED76193B1B7D} 5884
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3344
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F41EED86-8F7C-4C6E-AF3B-175269E57BB6} {8CB41BC5-334A-42A5-A5DB-302327894C2C} 3344
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:5816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1052
              4⤵
              • Program crash
              PID:2744
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5836
      • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
        "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4124
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:6052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3000 -ip 3000
        1⤵
          PID:5152
        • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
          "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3192 -ip 3192
          1⤵
            PID:2844

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e5909fe.rbs
                • Path C:\Config.Msi\e5909fe.rbs
                • Size 16KB
                • SHA256 ce8a4c30335daf0e9de3987d71828416b1cbc5e133c5b1360a2c409d8108f8de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a03.rbs
                • Path C:\Config.Msi\e590a03.rbs
                • Size 18KB
                • SHA256 4fbd73d976e2ca5630bbf2067e8f81b56df7fbfacc80d04200be01cda6b3e1cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a10.rbs
                • Path C:\Config.Msi\e590a10.rbs
                • Size 19KB
                • SHA256 469f18cda0c61c7c94199edb2ae95bba98e4680a6d153a2a09c1b268de4e8c24
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a1c.rbs
                • Path C:\Config.Msi\e590a1c.rbs
                • Size 19KB
                • SHA256 e40b383a03a02f0d57e1554ce53dd116d1f95b47faef298e371a92d6d265a496
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a23.rbs
                • Path C:\Config.Msi\e590a23.rbs
                • Size 20KB
                • SHA256 8c8d45a9d9550b9ec4190ebdc36b87aa054e0780dcbac7c1376db6a4e380e9c4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a32.rbs
                • Path C:\Config.Msi\e590a32.rbs
                • Size 19KB
                • SHA256 df8745e81214834908e0bc81233e871cbe38070a92e299a777c395abe03fd6ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a39.rbs
                • Path C:\Config.Msi\e590a39.rbs
                • Size 21KB
                • SHA256 5ef986e50a1d60a2311e7ceb0a088b346cfde85662d06b285aa22902c6d1758c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e590a48.rbs
                • Path C:\Config.Msi\e590a48.rbs
                • Size 21KB
                • SHA256 1f2e50bae178eda23df227e8d77205e4a443c7ed5df4ef3d940ca6cce1e900d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GalaxyClient.exe
                • Path C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
                • Size 13.9MB
                • SHA256 4904a284f4b41b0e9f41340b1da1b09ad91a4b28c311b122950a5710409ef508
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoData.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoData.dll
                • Size 2.0MB
                • SHA256 608a846082e26a302b3bd1f92af7ae5e3c52e948a66dcf21076fb2f2163fa249
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoDataSQLite.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll
                • Size 371KB
                • SHA256 a5c91d23111418f412a199458ebed4bb08b2b286f66918761ffaf890409c1ce3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoFoundation.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll
                • Size 1.9MB
                • SHA256 a77ea766a4f9877d05e07be701be49fee3d19ef91fe3a59812178fcbe3e9414f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoJSON.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll
                • Size 358KB
                • SHA256 cd8f8d80b656a4f5e2dd73284e8a4bcdcc342e3615699acf01d88f9d20cb9b6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoNet.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoNet.dll
                • Size 1.3MB
                • SHA256 cd2f025ff094abb855d2dba5415370aae63e71b71d0580fd33f38908e4aa8124
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PocoUtil.dll
                • Path C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll
                • Size 536KB
                • SHA256 ddaa338290c31d3f886ebd67102b732a69134bd2bc1f833cba9ddd6aedaabc72
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Qt5Core.dll
                • Path C:\Program Files (x86)\GOG Galaxy\Qt5Core.dll
                • Size 5.1MB
                • SHA256 ca75efab29b2f70e70f52fe2511c25d2a1ce70ad44378358d6356c2f44b79e56
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Qt5Gui.dll
                • Path C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll
                • Size 5.6MB
                • SHA256 6d3757baa088402153e4ed2c8e91e277b58756c7cb53c89280181007274fb3cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Qt5Network.dll
                • Path C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll
                • Size 1.0MB
                • SHA256 41951e90808d0463dc1527f85806420530dfbfb45d3b7d24032cbd71e0f62917
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                is-8RMUD.tmp
                • Path C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-8RMUD.tmp
                • Size 987KB
                • SHA256 73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sqlite.dll
                • Path C:\Program Files (x86)\GOG Galaxy\sqlite.dll
                • Size 903KB
                • SHA256 1cf2edcd5d6ef661449511630c8bffdcdbf8b55d4de20f3fa09179fd7ac8e96f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                is-UF2TK.tmp
                • Path C:\Program Files (x86)\GOG Galaxy\web\is-UF2TK.tmp
                • Size 26KB
                • SHA256 c64865dcae741f383efe2fb1e730d109b14b447afad422457b4b34d35bccb780
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                is-5C6NP.tmp
                • Path C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-5C6NP.tmp
                • Size 1KB
                • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                xdelta3.dll
                • Path C:\Program Files (x86)\GOG Galaxy\xdelta3.dll
                • Size 129KB
                • SHA256 533a9453759659b825df6af793212dd16ef897a6962634c90ed92cbda2b92692
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zlib1.dll
                • Path C:\Program Files (x86)\GOG Galaxy\zlib1.dll
                • Size 105KB
                • SHA256 cde02e8411fd25c6fbd2a988da94329b7a1c79b6a797a80bf53187c8961defc9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                is-AGQII.tmp
                • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-AGQII.tmp
                • Size 50KB
                • SHA256 259a1c5526db900207b820c3e74d5bb3e0c6bc7631bd11584b89d234088fc1e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                config.json
                • Path C:\ProgramData\GOG.com\Galaxy\config.json
                • Size 268B
                • SHA256 375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\ProgramData\GOG.com\Galaxy\config.json
                • Size 333B
                • SHA256 237fec0c257615eeb782ff2c5f20c02e2802b7fb1767d88c56d3ba9ca3d137d8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                is-8BVF9.tmp
                • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-8BVF9.tmp
                • Size 143KB
                • SHA256 edf3145f8c18aedf0f86f01db67e351c5a4ce5ad481e50a11ed7173a60a7d6cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000008
                • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\f_000008
                • Size 375KB
                • SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                temp-index
                • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\temp-index
                • Size 456B
                • SHA256 abaf6675844e319cf00d904fdd6ed3ca4af9ebb5a34f3daf31b206af3233979d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index~RFe59ac82.TMP
                • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\the-real-index~RFe59ac82.TMP
                • Size 48B
                • SHA256 7058da9e0b24369a2c24359d1c16ead2c258f295f49b35cebf7f0eb1337ceebd
                • MD5 SHA1 SHA512
                Submit Download

                CURRENT
                • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                state.rsm
                • Path C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\state.rsm
                • Size 960B
                • SHA256 e136cccc8a2023b42cecfd73342e090a538f22b0763eebf36bdf15dc796d29d2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
                • Size 1KB
                • SHA256 411d03f756be2b16ef15002cc386670b2a339aad8d59d615ce5bb9a71d6895e0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
                • Size 1KB
                • SHA256 fef6c3b7b2c21c98850d4838d324022addcb9ef2ed1c23a241f3638d487e579d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
                • Size 2KB
                • SHA256 e2e36d6a3169620b879811b93e1cb47427553ac72e447f4d32b1a4ff1a71bb1d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
                • Size 2KB
                • SHA256 beed860aa1b4a2945c5bc8a3fb384ea5935ca5cfbd62c8bdd69475d8cd4c6b9b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
                • Size 2KB
                • SHA256 656cb9855b9406f164278fde67a093f7d320e52cb18fb76a04e40dd63c149c07
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GalaxyInstaller.exe
                • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\GalaxyInstaller.exe
                • Size 120KB
                • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon.ico
                • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\icon.ico
                • Size 118KB
                • SHA256 ac7bc140b061d37257d12ede2d1df00cfbd723d2cb63a0d1774c6ff0946d70e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                remoteconfig.json
                • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_adivE\remoteconfig.json
                • Size 533B
                • SHA256 9d752b2d092657f995167f1f7396f217319e1a7ed25c0460bacc9969cb4e6dd3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dd_vcredist_amd64_20260629180529_000_vcRuntimeMinimum_x64.log
                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260629180529_000_vcRuntimeMinimum_x64.log
                • Size 3KB
                • SHA256 983de364b0d84d647472eed8db1f480cf3cdd8a9174c774efafc6cfa11c06cc3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dd_vcredist_x86_20260629180524.log
                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260629180524.log
                • Size 13KB
                • SHA256 e98b651596ffe973a322cbf91a0c1775afe49afe6a8d52395e8031aaaba069cf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dd_vcredist_x86_20260629180524_000_vcRuntimeMinimum_x86.log
                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260629180524_000_vcRuntimeMinimum_x86.log
                • Size 2KB
                • SHA256 1264b8521bb6a97993c5a45df6b83f846444dac05ab4d3c41b04b0c71ed5e34b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GalaxySetup.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\is-3ON85.tmp\GalaxySetup.tmp
                • Size 3.3MB
                • SHA256 2a5e824cf44dc6d66fe124b09a37180f84908e172f08b440dc4f64f17dde06df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VC_redist.x64.exe
                • Path C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x64.exe
                • Size 24.2MB
                • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VC_redist.x86.exe
                • Path C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\VC_redist.x86.exe
                • Size 13.2MB
                • SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _isdecmp.dll
                • Path C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\_isetup\_isdecmp.dll
                • Size 28KB
                • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                botva2.dll
                • Path C:\Users\Admin\AppData\Local\Temp\is-565O9.tmp\botva2.dll
                • Size 32KB
                • SHA256 13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VC_redist.x64.exe
                • Path C:\Windows\Temp\{0FB888AD-18AF-469D-B37B-A507A50117E7}\.cr\VC_redist.x64.exe
                • Size 635KB
                • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                logo.png
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\.ba\logo.png
                • Size 1KB
                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                wixstdba.dll
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\.ba\wixstdba.dll
                • Size 191KB
                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cab54A5CABBE7274D8A22EB58060AAB7623
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\cab54A5CABBE7274D8A22EB58060AAB7623
                • Size 822KB
                • SHA256 f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cabB3E1576D1FEFBB979E13B1A5379E0B16
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                • Size 4.9MB
                • SHA256 7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcRuntimeAdditional_x86
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\vcRuntimeAdditional_x86
                • Size 180KB
                • SHA256 be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcRuntimeMinimum_x86
                • Path C:\Windows\Temp\{515F368D-2B67-49B0-B4D7-CE17EB9783C7}\vcRuntimeMinimum_x86
                • Size 180KB
                • SHA256 a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VC_redist.x86.exe
                • Path C:\Windows\Temp\{5CB239A9-6CBA-45AE-9C23-03C365BEC1FF}\.cr\VC_redist.x86.exe
                • Size 634KB
                • SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\.ba\license.rtf
                • Size 9KB
                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\.ba\thm.wxl
                • Size 2KB
                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                thm.xml
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\.ba\thm.xml
                • Size 8KB
                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                • Size 5.4MB
                • SHA256 cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cab5046A8AB272BF37297BB7928664C9503
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\cab5046A8AB272BF37297BB7928664C9503
                • Size 962KB
                • SHA256 8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcRuntimeAdditional_x64
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\vcRuntimeAdditional_x64
                • Size 188KB
                • SHA256 7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcRuntimeMinimum_x64
                • Path C:\Windows\Temp\{8D3CDCE3-769C-4149-A029-AB5697DE9838}\vcRuntimeMinimum_x64
                • Size 188KB
                • SHA256 e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1028\license.rtf
                • Size 17KB
                • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1028\thm.wxl
                • Size 2KB
                • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1029\license.rtf
                • Size 12KB
                • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1029\thm.wxl
                • Size 3KB
                • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1031\license.rtf
                • Size 12KB
                • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1031\thm.wxl
                • Size 3KB
                • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1036\license.rtf
                • Size 12KB
                • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1036\thm.wxl
                • Size 3KB
                • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1040\license.rtf
                • Size 11KB
                • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1040\thm.wxl
                • Size 3KB
                • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1041\license.rtf
                • Size 29KB
                • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1041\thm.wxl
                • Size 3KB
                • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1042\license.rtf
                • Size 27KB
                • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1042\thm.wxl
                • Size 3KB
                • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1045\license.rtf
                • Size 13KB
                • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1045\thm.wxl
                • Size 3KB
                • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1046\license.rtf
                • Size 10KB
                • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1046\thm.wxl
                • Size 3KB
                • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1049\license.rtf
                • Size 31KB
                • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1049\thm.wxl
                • Size 4KB
                • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1055\license.rtf
                • Size 13KB
                • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\1055\thm.wxl
                • Size 3KB
                • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\2052\license.rtf
                • Size 17KB
                • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\2052\thm.wxl
                • Size 2KB
                • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                license.rtf
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\3082\license.rtf
                • Size 10KB
                • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{FBAA057D-35CD-46A0-89A7-0F8FD597DCF8}\.ba\3082\thm.wxl
                • Size 3KB
                • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/108-2835-0x0000000069F50000-0x000000006A3F8000-memory.dmp
                Download

                memory/1080-2847-0x0000000000400000-0x0000000000543000-memory.dmp
                Download

                memory/1080-56-0x0000000000400000-0x0000000000543000-memory.dmp
                Download

                memory/1080-1169-0x0000000000400000-0x0000000000543000-memory.dmp
                Download

                memory/1168-0-0x0000000000010000-0x000000000010B000-memory.dmp
                Download

                memory/1816-3013-0x00000000005A0000-0x0000000000617000-memory.dmp
                Download

                memory/1936-2090-0x0000000000400000-0x0000000000765000-memory.dmp
                Download

                memory/1936-2846-0x0000000000400000-0x0000000000765000-memory.dmp
                Download

                memory/1936-1170-0x0000000000400000-0x0000000000765000-memory.dmp
                Download

                memory/1936-1171-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
                Download

                memory/1936-74-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
                Download

                memory/1936-2838-0x0000000000400000-0x0000000000765000-memory.dmp
                Download

                memory/3344-3009-0x00000000005A0000-0x0000000000617000-memory.dmp
                Download

                memory/5816-3003-0x00000000005A0000-0x0000000000617000-memory.dmp
                Download

                memory/5820-36-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-2854-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-9-0x00007FFD5A62F000-0x00007FFD5A630000-memory.dmp
                Download

                memory/5820-10-0x0000000000480000-0x00000000004A0000-memory.dmp
                Download

                memory/5820-11-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-12-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-13-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-24-0x000000001E460000-0x000000001E622000-memory.dmp
                Download

                memory/5820-25-0x000000001EB60000-0x000000001F088000-memory.dmp
                Download

                memory/5820-26-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-27-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-28-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-30-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-31-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-34-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-35-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-37-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-39-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-38-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-42-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-41-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download

                memory/5820-40-0x00007FFD5A4A0000-0x00007FFD5AE44000-memory.dmp
                Download