Overview

overview

9

Static

static

3

2026-07-04...os.exe

windows10-2004-x64

9

2026-07-04...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 02:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_fef9d5554aa4b0fdded2fa5fddf9c3df_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 996KB
  • Sample260704-c5v7caex2k
  • SHA256 055206fda93c69eab7a82a0b2d1f959597794f0799274de6340bd2f1aaa8b89d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_fef9d5554aa4b0fdded2fa5fddf9c3df_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_fef9d5554aa4b0fdded2fa5fddf9c3df_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxyInstaller.exe" 1207658778 "Lords of Magic: Special Edition"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207658778 /silent /game_name="Lords of Magic: Special Edition"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Users\Admin\AppData\Local\Temp\is-65EPV.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-65EPV.tmp\GalaxySetup.tmp" /SL5="$902D0,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207658778 /silent /game_name="Lords of Magic: Special Edition"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5860
          • C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4992
            • C:\Windows\Temp\{1859D5AA-6650-4E14-BB46-786BEBE5CDAC}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{1859D5AA-6650-4E14-BB46-786BEBE5CDAC}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=736 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1204
              • C:\Windows\Temp\{CF5C35FF-612B-4442-A4B3-1E581A40B678}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{CF5C35FF-612B-4442-A4B3-1E581A40B678}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D56C75A2-9416-462A-AD39-0F4A668E0434} {1EB69E51-ADD4-4241-9E95-966C2D88C9FC} 1204
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1560
          • C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5760
            • C:\Windows\Temp\{EBE9961E-A426-4238-9B1B-1DE32F5E84E1}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{EBE9961E-A426-4238-9B1B-1DE32F5E84E1}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:988
              • C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{18264304-DB7E-4566-9A1A-7E0121E2F7B5} {82BB0BD4-C7FA-45D2-AF71-8D085925F3F3} 988
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:1332
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1044
                7⤵
                • Program crash
                PID:2408
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4184
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2780
    • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1207658778
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6044
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3760,13262882023545217014,15189332501293393985,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=1602734811396418995 --mojo-platform-channel-handle=3756 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:5324
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3760,13262882023545217014,15189332501293393985,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=3783153687547970845 --renderer-client-id=3 --mojo-platform-channel-handle=4564 /prefetch:1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4756
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3760,13262882023545217014,15189332501293393985,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=17397643132896353724 --mojo-platform-channel-handle=5688 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2884
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:256
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:2660
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4796
    • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260704034123.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5868
        • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260704034123.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{74AF346B-7480-4E4D-8ACB-C154EAC0A08A} {63D1B247-08EE-4190-92C0-83F24AF3998F} 2952
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5008
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 1260
            4⤵
            • Program crash
            PID:4256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 988 -ip 988
      1⤵
        PID:4836
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5996
      • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
        "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:6020
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1332
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2952 -ip 2952
        1⤵
          PID:4712

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5a0083.rbs
              • Path C:\Config.Msi\e5a0083.rbs
              • Size 19KB
              • SHA256 7dd834e8e25b1f10c4d2b9a54a6f72a46bbc34cdbe8ceb26137f4d291046e44e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a008f.rbs
              • Path C:\Config.Msi\e5a008f.rbs
              • Size 19KB
              • SHA256 57d0d47d07721bc518c57752bdc24dcf35d19fcfba9672637af5fd76d5a1e96c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a0096.rbs
              • Path C:\Config.Msi\e5a0096.rbs
              • Size 21KB
              • SHA256 c379df1e240b185eab009fa1d9e3566ea08d2f38ccff527010f6dcdc7df50098
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a00a5.rbs
              • Path C:\Config.Msi\e5a00a5.rbs
              • Size 21KB
              • SHA256 7c93e7b697f0c3ebc9a0f243047e402476e70fb4904723f4b1a109b0ea0a4def
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GalaxyClient.exe
              • Path C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
              • Size 13.9MB
              • SHA256 4904a284f4b41b0e9f41340b1da1b09ad91a4b28c311b122950a5710409ef508
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoData.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoData.dll
              • Size 2.0MB
              • SHA256 608a846082e26a302b3bd1f92af7ae5e3c52e948a66dcf21076fb2f2163fa249
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoDataSQLite.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll
              • Size 371KB
              • SHA256 a5c91d23111418f412a199458ebed4bb08b2b286f66918761ffaf890409c1ce3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoFoundation.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll
              • Size 1.9MB
              • SHA256 a77ea766a4f9877d05e07be701be49fee3d19ef91fe3a59812178fcbe3e9414f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoJSON.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll
              • Size 358KB
              • SHA256 cd8f8d80b656a4f5e2dd73284e8a4bcdcc342e3615699acf01d88f9d20cb9b6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoNet.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoNet.dll
              • Size 1.3MB
              • SHA256 cd2f025ff094abb855d2dba5415370aae63e71b71d0580fd33f38908e4aa8124
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoUtil.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll
              • Size 536KB
              • SHA256 ddaa338290c31d3f886ebd67102b732a69134bd2bc1f833cba9ddd6aedaabc72
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoXML.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoXML.dll
              • Size 537KB
              • SHA256 a9bbbf43bfc7228d1c4c0ab3d7c6afb5a12effad8f4d77790f11fa254f6a9edc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoZip.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoZip.dll
              • Size 284KB
              • SHA256 7c1d79888faf389bff9aed6fd105ad568d4b5a3288a0df992affbe811fc946f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Core.dll
              • Path C:\Program Files (x86)\GOG Galaxy\Qt5Core.dll
              • Size 5.1MB
              • SHA256 ca75efab29b2f70e70f52fe2511c25d2a1ce70ad44378358d6356c2f44b79e56
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Gui.dll
              • Path C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll
              • Size 5.6MB
              • SHA256 6d3757baa088402153e4ed2c8e91e277b58756c7cb53c89280181007274fb3cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Network.dll
              • Path C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll
              • Size 1.0MB
              • SHA256 41951e90808d0463dc1527f85806420530dfbfb45d3b7d24032cbd71e0f62917
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-1_1.dll
              • Path C:\Program Files (x86)\GOG Galaxy\libcrypto-1_1.dll
              • Size 2.4MB
              • SHA256 29b184c212af39cfafba8fda13db9fb742e209821cbe2cd616f72878481849e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _http_parser.c
              • Path C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\_http_parser.c
              • Size 987KB
              • SHA256 73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sqlite.dll
              • Path C:\Program Files (x86)\GOG Galaxy\sqlite.dll
              • Size 903KB
              • SHA256 1cf2edcd5d6ef661449511630c8bffdcdbf8b55d4de20f3fa09179fd7ac8e96f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-D629J.tmp
              • Path C:\Program Files (x86)\GOG Galaxy\web\is-D629J.tmp
              • Size 26KB
              • SHA256 c64865dcae741f383efe2fb1e730d109b14b447afad422457b4b34d35bccb780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-0PTBF.tmp
              • Path C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-0PTBF.tmp
              • Size 1KB
              • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              xdelta3.dll
              • Path C:\Program Files (x86)\GOG Galaxy\xdelta3.dll
              • Size 129KB
              • SHA256 533a9453759659b825df6af793212dd16ef897a6962634c90ed92cbda2b92692
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              zlib1.dll
              • Path C:\Program Files (x86)\GOG Galaxy\zlib1.dll
              • Size 105KB
              • SHA256 cde02e8411fd25c6fbd2a988da94329b7a1c79b6a797a80bf53187c8961defc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-B8SM2.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-B8SM2.tmp
              • Size 50KB
              • SHA256 259a1c5526db900207b820c3e74d5bb3e0c6bc7631bd11584b89d234088fc1e3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 268B
              • SHA256 375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 333B
              • SHA256 235c8150d995e8c0c276f1398ab6d68e1a5f3ac15f7ffa28f04d9f4cc15d0108
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-UNP01.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-UNP01.tmp
              • Size 143KB
              • SHA256 edf3145f8c18aedf0f86f01db67e351c5a4ce5ad481e50a11ed7173a60a7d6cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f_000008
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\f_000008
              • Size 374KB
              • SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              temp-index
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\temp-index
              • Size 456B
              • SHA256 d885dccfbbe97c969e69a3c32a47d6a8998d39ed79b8436e3887cc5169dac6dd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index~RFe5a982a.TMP
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\the-real-index~RFe5a982a.TMP
              • Size 48B
              • SHA256 ea904038a014f247fb9499dba326a203005491d79f164d25d6066bb5351b33aa
              • MD5 SHA1 SHA512
              Submit Download

              CURRENT
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              config.json
              • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
              • Size 1KB
              • SHA256 66d826dee6d0ef632fbd41a3df5ed90d894f475bf418d9dc6a36fc9ebe09d2ff
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
              • Size 2KB
              • SHA256 656cb9855b9406f164278fde67a093f7d320e52cb18fb76a04e40dd63c149c07
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxyInstaller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\GalaxyInstaller.exe
              • Size 120KB
              • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icon.ico
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\icon.ico
              • Size 111KB
              • SHA256 3e7ce4e788c8caa38e2e750059b5e3506808ed76ce1e6426839f736b77d69be6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              remoteconfig.json
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_qmxEm\remoteconfig.json
              • Size 533B
              • SHA256 9d752b2d092657f995167f1f7396f217319e1a7ed25c0460bacc9969cb4e6dd3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260704034123.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260704034123.log
              • Size 14KB
              • SHA256 151abb13ee0285320a386db38180c7cc08e9d70ffdf14f37792191979a7f7c70
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260704034123_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260704034123_000_vcRuntimeMinimum_x64.log
              • Size 3KB
              • SHA256 51e7d9c571760bca04d0f4cabe5dc45f8ee1ec24ac3f40e6ef13b1ecfb1b112c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxySetup.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-65EPV.tmp\GalaxySetup.tmp
              • Size 3.3MB
              • SHA256 2a5e824cf44dc6d66fe124b09a37180f84908e172f08b440dc4f64f17dde06df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x64.exe
              • Size 24.2MB
              • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x86.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\VC_redist.x86.exe
              • Size 13.2MB
              • SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isdecmp.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\_isetup\_isdecmp.dll
              • Size 28KB
              • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              botva2.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-PVLNT.tmp\botva2.dll
              • Size 32KB
              • SHA256 13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x86.exe
              • Path C:\Windows\Temp\{1859D5AA-6650-4E14-BB46-786BEBE5CDAC}\.cr\VC_redist.x86.exe
              • Size 634KB
              • SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\cab5046A8AB272BF37297BB7928664C9503
              • Size 962KB
              • SHA256 8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\vcRuntimeAdditional_x64
              • Size 188KB
              • SHA256 7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{628D1516-DA61-4A27-B915-244CB872E7AD}\vcRuntimeMinimum_x64
              • Size 188KB
              • SHA256 e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Windows\Temp\{7E3B0B10-A900-4CF6-B0D3-4EF0293EEF6E}\.ba\license.rtf
              • Size 9KB
              • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              thm.wxl
              • Path C:\Windows\Temp\{7E3B0B10-A900-4CF6-B0D3-4EF0293EEF6E}\.ba\thm.wxl
              • Size 2KB
              • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thm.xml
              • Path C:\Windows\Temp\{7E3B0B10-A900-4CF6-B0D3-4EF0293EEF6E}\.ba\thm.xml
              • Size 8KB
              • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{CF5C35FF-612B-4442-A4B3-1E581A40B678}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{CF5C35FF-612B-4442-A4B3-1E581A40B678}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Windows\Temp\{EBE9961E-A426-4238-9B1B-1DE32F5E84E1}\.cr\VC_redist.x64.exe
              • Size 635KB
              • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1044-0-0x0000000000B30000-0x0000000000C2A000-memory.dmp
              Download

              memory/3824-1784-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/3824-2761-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/3824-61-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/4540-49-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-36-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-11-0x00007FFA77F1F000-0x00007FFA77F20000-memory.dmp
              Download

              memory/4540-12-0x0000000000510000-0x0000000000530000-memory.dmp
              Download

              memory/4540-57-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-13-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-46-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-48-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-47-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-45-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-43-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-40-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-39-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-37-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-38-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-14-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-35-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-31-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-30-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-29-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-15-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-28-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/4540-26-0x000000001E490000-0x000000001E652000-memory.dmp
              Download

              memory/4540-27-0x000000001EB90000-0x000000001F0B8000-memory.dmp
              Download

              memory/4540-2768-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp
              Download

              memory/5860-2009-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/5860-2760-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/5860-2505-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/5860-1785-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/5860-2074-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/5860-1786-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
              Download

              memory/5860-79-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
              Download