Overview

overview

9

Static

static

3

2026-07-04...os.exe

windows10-2004-x64

7

2026-07-04...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_ac6bb552804086500437629f3adb55d5_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1003KB
  • Sample260704-mbkhvsd12s
  • SHA256 e79cf4a18c59a6e67f26c46070359af0722359e890f9b2d6d3ae714755443065
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_ac6bb552804086500437629f3adb55d5_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_ac6bb552804086500437629f3adb55d5_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxyInstaller.exe" 1914671919 "XCOM®: Chimera Squad"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:796
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1914671919 /silent /game_name="XCOM®: Chimera Squad"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Users\Admin\AppData\Local\Temp\is-56BTC.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-56BTC.tmp\GalaxySetup.tmp" /SL5="$7026A,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1914671919 /silent /game_name="XCOM®: Chimera Squad"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:468
          • C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3616
            • C:\Windows\Temp\{45C45DEA-6180-4929-BCF1-89DF040C3640}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{45C45DEA-6180-4929-BCF1-89DF040C3640}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x86.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2404
              • C:\Windows\Temp\{BAF2403E-27DF-41A6-BC05-E0EF37BE376D}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{BAF2403E-27DF-41A6-BC05-E0EF37BE376D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0CFDF79C-544F-4F31-AA27-A43AE0EFE2B0} {DCE4774D-EF19-4C4D-A1CD-E189A5A9AAC2} 2404
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2268
          • C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Windows\Temp\{06A1C410-EC98-482B-A3B0-DB8877AD8E8F}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{06A1C410-EC98-482B-A3B0-DB8877AD8E8F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1668
              • C:\Windows\Temp\{6A4020CA-3AB3-42C9-9072-AB47F9F3E801}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{6A4020CA-3AB3-42C9-9072-AB47F9F3E801}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CFCABFB2-FD76-4BD2-AB3E-193CB0DB4917} {1E22D4F1-7A2E-44FA-B5DA-0529ED31899E} 1668
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:5788
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:5828
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1908
    • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1914671919
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3752,13001410018666875034,12940185420816025438,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=11944997388409916821 --mojo-platform-channel-handle=3772 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:5976
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3752,13001410018666875034,12940185420816025438,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=15243977077277267328 --renderer-client-id=3 --mojo-platform-channel-handle=4564 /prefetch:1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2880
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3752,13001410018666875034,12940185420816025438,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=17201369345065219881 --mojo-platform-channel-handle=5480 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:6016
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5808
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1776
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4972
  • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
    "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4416
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2236
  • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4948

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GalaxyClient.exe
        • Path C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
        • Size 13.9MB
        • SHA256 4904a284f4b41b0e9f41340b1da1b09ad91a4b28c311b122950a5710409ef508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoData.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoData.dll
        • Size 2.0MB
        • SHA256 608a846082e26a302b3bd1f92af7ae5e3c52e948a66dcf21076fb2f2163fa249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoDataSQLite.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll
        • Size 371KB
        • SHA256 a5c91d23111418f412a199458ebed4bb08b2b286f66918761ffaf890409c1ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoFoundation.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll
        • Size 1.9MB
        • SHA256 a77ea766a4f9877d05e07be701be49fee3d19ef91fe3a59812178fcbe3e9414f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoJSON.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll
        • Size 358KB
        • SHA256 cd8f8d80b656a4f5e2dd73284e8a4bcdcc342e3615699acf01d88f9d20cb9b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoNet.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoNet.dll
        • Size 1.3MB
        • SHA256 cd2f025ff094abb855d2dba5415370aae63e71b71d0580fd33f38908e4aa8124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoUtil.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll
        • Size 536KB
        • SHA256 ddaa338290c31d3f886ebd67102b732a69134bd2bc1f833cba9ddd6aedaabc72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoXML.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoXML.dll
        • Size 537KB
        • SHA256 a9bbbf43bfc7228d1c4c0ab3d7c6afb5a12effad8f4d77790f11fa254f6a9edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoZip.dll
        • Path C:\Program Files (x86)\GOG Galaxy\PocoZip.dll
        • Size 284KB
        • SHA256 7c1d79888faf389bff9aed6fd105ad568d4b5a3288a0df992affbe811fc946f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\GOG Galaxy\Qt5Core.dll
        • Size 5.1MB
        • SHA256 ca75efab29b2f70e70f52fe2511c25d2a1ce70ad44378358d6356c2f44b79e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll
        • Size 5.6MB
        • SHA256 6d3757baa088402153e4ed2c8e91e277b58756c7cb53c89280181007274fb3cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll
        • Size 1.0MB
        • SHA256 41951e90808d0463dc1527f85806420530dfbfb45d3b7d24032cbd71e0f62917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_elf.dll
        • Path C:\Program Files (x86)\GOG Galaxy\chrome_elf.dll
        • Size 703KB
        • SHA256 4812cd1add94743b0eaaae4cb334561ef94b60d911c043ecd34c891b17ab9a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Program Files (x86)\GOG Galaxy\libcrypto-1_1.dll
        • Size 2.4MB
        • SHA256 29b184c212af39cfafba8fda13db9fb742e209821cbe2cd616f72878481849e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libexpat.dll
        • Path C:\Program Files (x86)\GOG Galaxy\libexpat.dll
        • Size 173KB
        • SHA256 b818629bd475286f6fc39d45b0da86a6f0685af5be1f29623fed8f9493331734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pcre2-8.dll
        • Path C:\Program Files (x86)\GOG Galaxy\pcre2-8.dll
        • Size 573KB
        • SHA256 a4e9215d74aa658626d91e7dbaa3bc2e13372452bdbefebe68281b478c280ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-GERTR.tmp
        • Path C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-GERTR.tmp
        • Size 987KB
        • SHA256 73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite.dll
        • Path C:\Program Files (x86)\GOG Galaxy\sqlite.dll
        • Size 903KB
        • SHA256 1cf2edcd5d6ef661449511630c8bffdcdbf8b55d4de20f3fa09179fd7ac8e96f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-MML7F.tmp
        • Path C:\Program Files (x86)\GOG Galaxy\web\is-MML7F.tmp
        • Size 26KB
        • SHA256 c64865dcae741f383efe2fb1e730d109b14b447afad422457b4b34d35bccb780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-FQQ9H.tmp
        • Path C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-FQQ9H.tmp
        • Size 1KB
        • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        xdelta3.dll
        • Path C:\Program Files (x86)\GOG Galaxy\xdelta3.dll
        • Size 129KB
        • SHA256 533a9453759659b825df6af793212dd16ef897a6962634c90ed92cbda2b92692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Program Files (x86)\GOG Galaxy\zlib1.dll
        • Size 105KB
        • SHA256 cde02e8411fd25c6fbd2a988da94329b7a1c79b6a797a80bf53187c8961defc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-MRMDE.tmp
        • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-MRMDE.tmp
        • Size 50KB
        • SHA256 259a1c5526db900207b820c3e74d5bb3e0c6bc7631bd11584b89d234088fc1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\ProgramData\GOG.com\Galaxy\config.json
        • Size 268B
        • SHA256 375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.json
        • Path C:\ProgramData\GOG.com\Galaxy\config.json
        • Size 333B
        • SHA256 04b901ce9c5ebae081594f8a77cca8b1d85b2dc32b8fe2f59d8aeebb955004fb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GalaxyClientService.log
        • Path C:\ProgramData\GOG.com\Galaxy\logs\GalaxyClientService.log
        • Size 17KB
        • SHA256 9507f899715decb8de4b8c8b6f220d62ae856a8b5855db2a1c895259dd1159a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallerWebinstaller.log
        • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
        • Size 721B
        • SHA256 b77f89b2f4f3cff96641355cc88831bb3c4cca446332e5a7ad3dfe70c5f256a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-5CI15.tmp
        • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-5CI15.tmp
        • Size 143KB
        • SHA256 edf3145f8c18aedf0f86f01db67e351c5a4ce5ad481e50a11ed7173a60a7d6cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f_000008
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\f_000008
        • Size 374KB
        • SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp-index
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\temp-index
        • Size 456B
        • SHA256 12c0511251a87932b6000549ae43636a7804c7d1acdbea5e9e42c273fadd3ec8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index~RFe5b0898.TMP
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\the-real-index~RFe5b0898.TMP
        • Size 48B
        • SHA256 d57a842fa00065afa8bf2d3ef92fdcc9d067d0ebf6b9ac50a228df4750e66748
        • MD5 SHA1 SHA512
        Submit Download

        CURRENT
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
        • Size 2KB
        • SHA256 656cb9855b9406f164278fde67a093f7d320e52cb18fb76a04e40dd63c149c07
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GalaxyInstaller.exe
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\GalaxyInstaller.exe
        • Size 120KB
        • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\icon.ico
        • Size 119KB
        • SHA256 dbff09b2eea27e0fcd52dadfebd25e2a7beae8ec6ae13fab1775b54108524df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        remoteconfig.json
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_gCqEn\remoteconfig.json
        • Size 533B
        • SHA256 9d752b2d092657f995167f1f7396f217319e1a7ed25c0460bacc9969cb4e6dd3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GalaxySetup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-56BTC.tmp\GalaxySetup.tmp
        • Size 3.3MB
        • SHA256 2a5e824cf44dc6d66fe124b09a37180f84908e172f08b440dc4f64f17dde06df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x64.exe
        • Size 24.2MB
        • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\VC_redist.x86.exe
        • Size 13.2MB
        • SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isdecmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\_isetup\_isdecmp.dll
        • Size 28KB
        • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        botva2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-USOH8.tmp\botva2.dll
        • Size 32KB
        • SHA256 13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{06A1C410-EC98-482B-A3B0-DB8877AD8E8F}\.cr\VC_redist.x64.exe
        • Size 635KB
        • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x86.exe
        • Path C:\Windows\Temp\{45C45DEA-6180-4929-BCF1-89DF040C3640}\.cr\VC_redist.x86.exe
        • Size 634KB
        • SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{BAF2403E-27DF-41A6-BC05-E0EF37BE376D}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{BAF2403E-27DF-41A6-BC05-E0EF37BE376D}\.ba\wixstdba.dll
        • Size 191KB
        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/468-2013-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/468-2068-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/468-2690-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/468-1731-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/468-1732-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
        Download

        memory/468-83-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
        Download

        memory/468-70-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/468-2680-0x0000000000400000-0x0000000000765000-memory.dmp
        Download

        memory/796-39-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-30-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-44-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-43-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-42-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-41-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-40-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-38-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-11-0x00007FFBC52AF000-0x00007FFBC52B0000-memory.dmp
        Download

        memory/796-37-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-36-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-35-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-34-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-45-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-29-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-28-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-27-0x000000001F530000-0x000000001FA58000-memory.dmp
        Download

        memory/796-12-0x0000000000FD0000-0x0000000000FF0000-memory.dmp
        Download

        memory/796-13-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-14-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-2697-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/796-25-0x000000001EE30000-0x000000001EFF2000-memory.dmp
        Download

        memory/796-26-0x00007FFBC5120000-0x00007FFBC5AC4000-memory.dmp
        Download

        memory/3356-0-0x00000000004E0000-0x00000000005DC000-memory.dmp
        Download

        memory/3676-2691-0x0000000000400000-0x0000000000543000-memory.dmp
        Download

        memory/3676-69-0x0000000000400000-0x0000000000543000-memory.dmp
        Download

        memory/3676-59-0x0000000000400000-0x0000000000543000-memory.dmp
        Download