Overview

overview

10

Static

static

10

2026-07-10...os.exe

windows10-2004-x64

9

2026-07-10...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 06:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_197088bddff710ad73984bdbfb19c427_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 2.4MB
  • Sample260710-gv76daft5y
  • SHA256 d233cb4619adf6f0798ecd11c589a9de8055206451251c5fdc7fcd2271f7a652
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywaretrojanupx

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 60 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_197088bddff710ad73984bdbfb19c427_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_197088bddff710ad73984bdbfb19c427_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxyInstaller.exe" 1971477531 "GWENT: The Witcher Card Game"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Users\Admin\AppData\Local\Temp\is-G3RCS.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-G3RCS.tmp\GalaxySetup.tmp" /SL5="$C0082,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4400
            • C:\Windows\Temp\{4971DC63-C892-4AA7-AD27-AFBF0AAEAA21}\.cr\VC_redist.x86.exe
              "C:\Windows\Temp\{4971DC63-C892-4AA7-AD27-AFBF0AAEAA21}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x86.exe" -burn.filehandle.attached=580 -burn.filehandle.self=588 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5524
              • C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{F6AB965F-AA6A-4F05-A8CA-12015B8CB12F} {131C464F-C2C4-428D-88A1-AF0137F4F4DD} 5524
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:5828
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 952
                7⤵
                • Program crash
                PID:1516
          • C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5348
            • C:\Windows\Temp\{314F965A-50E8-42D5-9015-0E4E2C3D8DF3}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{314F965A-50E8-42D5-9015-0E4E2C3D8DF3}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BD490A17-B5AA-4B7F-ACE8-B523F6DA2ED4} {04537EFA-A7B9-42F7-889C-CA399C09F847} 2028
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3296
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1552
                7⤵
                • Program crash
                PID:1240
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3592
          • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2488
    • C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1971477531
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3744,4578564360784660366,5955082817360864716,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=4841084435616150185 --mojo-platform-channel-handle=3736 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:4612
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3744,4578564360784660366,5955082817360864716,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2764303933418172590 --renderer-client-id=3 --mojo-platform-channel-handle=4532 /prefetch:1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4836
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe
        "C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3744,4578564360784660366,5955082817360864716,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=8577406289570044472 --mojo-platform-channel-handle=2372 /prefetch:2
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2704
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4120
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5784
  • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710070958.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5960
      • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710070958.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{340F606E-D52A-4F9D-AACF-E2BFFB1CC648} {7539C22E-FF60-48F4-B219-E0C78919AB6A} 4528
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:4256
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1260
          4⤵
          • Program crash
          PID:3872
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5524 -ip 5524
    1⤵
      PID:3796
    • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710071002.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710071002.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B8C402D3-AAAD-4EF4-8AB3-D0F16914E388} {08DE5451-E096-4911-95C4-3433B95C2CB6} 4540
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2028 -ip 2028
      1⤵
        PID:2788
      • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4316
      • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
        "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4528 -ip 4528
        1⤵
          PID:3232
        • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
          "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5932
        • C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe
          "\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4908

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5a2fff.rbs
              • Path C:\Config.Msi\e5a2fff.rbs
              • Size 16KB
              • SHA256 84a012d4ed763087f71a884bc85d1e836e78a80cdecc2b54a1d09290c9c8e85a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a3004.rbs
              • Path C:\Config.Msi\e5a3004.rbs
              • Size 18KB
              • SHA256 12dfffa28d668ecf758f55ce50316f79648c1925884ddd0f1eb2dbf8fdb1a967
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a3017.rbs
              • Path C:\Config.Msi\e5a3017.rbs
              • Size 20KB
              • SHA256 76b0c49647000fc82eaf1ec86e5114ddd5d44cd2fd7558465eacd87c1658074a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a3026.rbs
              • Path C:\Config.Msi\e5a3026.rbs
              • Size 19KB
              • SHA256 4e36ca8f87d4c92e698a100d9ecf527b9e8cb71133b69ebae931b1ba85a1e6a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GalaxyClient.exe
              • Path C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe
              • Size 13.9MB
              • SHA256 4904a284f4b41b0e9f41340b1da1b09ad91a4b28c311b122950a5710409ef508
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoData.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoData.dll
              • Size 2.0MB
              • SHA256 608a846082e26a302b3bd1f92af7ae5e3c52e948a66dcf21076fb2f2163fa249
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoDataSQLite.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoDataSQLite.dll
              • Size 371KB
              • SHA256 a5c91d23111418f412a199458ebed4bb08b2b286f66918761ffaf890409c1ce3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoFoundation.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoFoundation.dll
              • Size 1.9MB
              • SHA256 a77ea766a4f9877d05e07be701be49fee3d19ef91fe3a59812178fcbe3e9414f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoJSON.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoJSON.dll
              • Size 358KB
              • SHA256 cd8f8d80b656a4f5e2dd73284e8a4bcdcc342e3615699acf01d88f9d20cb9b6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoNet.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoNet.dll
              • Size 1.3MB
              • SHA256 cd2f025ff094abb855d2dba5415370aae63e71b71d0580fd33f38908e4aa8124
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoUtil.dll
              • Path C:\Program Files (x86)\GOG Galaxy\PocoUtil.dll
              • Size 536KB
              • SHA256 ddaa338290c31d3f886ebd67102b732a69134bd2bc1f833cba9ddd6aedaabc72
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Gui.dll
              • Path C:\Program Files (x86)\GOG Galaxy\Qt5Gui.dll
              • Size 5.6MB
              • SHA256 6d3757baa088402153e4ed2c8e91e277b58756c7cb53c89280181007274fb3cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Network.dll
              • Path C:\Program Files (x86)\GOG Galaxy\Qt5Network.dll
              • Size 1.0MB
              • SHA256 41951e90808d0463dc1527f85806420530dfbfb45d3b7d24032cbd71e0f62917
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-C30LD.tmp
              • Path C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-C30LD.tmp
              • Size 987KB
              • SHA256 73185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-G4S95.tmp
              • Path C:\Program Files (x86)\GOG Galaxy\web\is-G4S95.tmp
              • Size 26KB
              • SHA256 c64865dcae741f383efe2fb1e730d109b14b447afad422457b4b34d35bccb780
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-L8TKC.tmp
              • Path C:\Program Files (x86)\GOG Galaxy\web\locales\pt-PT\is-L8TKC.tmp
              • Size 1KB
              • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              xdelta3.dll
              • Path C:\Program Files (x86)\GOG Galaxy\xdelta3.dll
              • Size 129KB
              • SHA256 533a9453759659b825df6af793212dd16ef897a6962634c90ed92cbda2b92692
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              zlib1.dll
              • Path C:\Program Files (x86)\GOG Galaxy\zlib1.dll
              • Size 105KB
              • SHA256 cde02e8411fd25c6fbd2a988da94329b7a1c79b6a797a80bf53187c8961defc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-G8CG5.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-G8CG5.tmp
              • Size 50KB
              • SHA256 259a1c5526db900207b820c3e74d5bb3e0c6bc7631bd11584b89d234088fc1e3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 268B
              • SHA256 375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 333B
              • SHA256 7d5a7ed23d0f53bda262e02d9f394e13eed74ce33bd36f8a50008fef18efd9e7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxyClientService.log
              • Path C:\ProgramData\GOG.com\Galaxy\logs\GalaxyClientService.log
              • Size 18KB
              • SHA256 121fea22e659a58fd806f5859b2e5457a4f2bb247f98ff6ba601fc0a2dd54fc2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InstallerWebinstaller.log
              • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
              • Size 728B
              • SHA256 63e7d56b2b913c3f1d5b358c3b62db037b06d53a4b0729d5ae3c51374ae51559
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-K1UPS.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-K1UPS.tmp
              • Size 143KB
              • SHA256 edf3145f8c18aedf0f86f01db67e351c5a4ce5ad481e50a11ed7173a60a7d6cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f_00000b
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\f_00000b
              • Size 373KB
              • SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              temp-index
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\temp-index
              • Size 504B
              • SHA256 d3bb14bf1cc5440b54c2115ec500a4e92ea2bd12772c34350916b122473157d5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index~RFe5ae9f4.TMP
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Code Cache\js\index-dir\the-real-index~RFe5ae9f4.TMP
              • Size 48B
              • SHA256 37ed35708f2b0d17ac3626853817742e78f54101e0ce6745aad842863c5ef886
              • MD5 SHA1 SHA512
              Submit Download

              CURRENT
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\state.rsm
              • Size 960B
              • SHA256 2ff25db161cee5e711b9555605ddbfde6268a736804d741a473bcd844effdf9e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\state.rsm
              • Size 964B
              • SHA256 ce3b9af589aaa2dc2175063e830fee76710813973e1c38cb8c094c82e2b6467b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
              • Size 2KB
              • SHA256 656cb9855b9406f164278fde67a093f7d320e52cb18fb76a04e40dd63c149c07
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxyInstaller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\GalaxyInstaller.exe
              • Size 607KB
              • SHA256 0fc3b42a96b6ac0fa20556bac1d6a58071436952cddd8655545dc24ff207a09a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icon.ico
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\icon.ico
              • Size 520KB
              • SHA256 d09ccaf753e884a02976544208a33b72a17e74eba9a0254b355554752f4a267f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              remoteconfig.json
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_rnNVo\remoteconfig.json
              • Size 533B
              • SHA256 9d752b2d092657f995167f1f7396f217319e1a7ed25c0460bacc9969cb4e6dd3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260710071002.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710071002.log
              • Size 14KB
              • SHA256 a00f90213ebcdf545274a93ab95b0bd0064a12bf779172dd6022df02afa6980e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260710071002_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710071002_000_vcRuntimeMinimum_x64.log
              • Size 2KB
              • SHA256 a353d86cb7913d097e1c0e7359f26bae5092bd21f795c636c9b46e21c170b2fe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_x86_20260710070958.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710070958.log
              • Size 13KB
              • SHA256 c7363e49a32e6b359aa109ee61da50ae580420f3cb8e9c907c9f9d7b8f7f8a1f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_x86_20260710070958_000_vcRuntimeMinimum_x86.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710070958_000_vcRuntimeMinimum_x86.log
              • Size 2KB
              • SHA256 5684ae4b3678987d4ad172afb00aeff730a3583cd8af2b8bf4d56b65ab8ce34b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxySetup.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-G3RCS.tmp\GalaxySetup.tmp
              • Size 3.3MB
              • SHA256 2a5e824cf44dc6d66fe124b09a37180f84908e172f08b440dc4f64f17dde06df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x64.exe
              • Size 24.2MB
              • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x86.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\VC_redist.x86.exe
              • Size 13.2MB
              • SHA256 a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isdecmp.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\_isetup\_isdecmp.dll
              • Size 28KB
              • SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              botva2.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-GKHDV.tmp\botva2.dll
              • Size 32KB
              • SHA256 13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Windows\Temp\{314F965A-50E8-42D5-9015-0E4E2C3D8DF3}\.cr\VC_redist.x64.exe
              • Size 635KB
              • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x86.exe
              • Path C:\Windows\Temp\{4971DC63-C892-4AA7-AD27-AFBF0AAEAA21}\.cr\VC_redist.x86.exe
              • Size 634KB
              • SHA256 81873c2f6c8bc4acaad66423a1b4d90e70214e59710ea7f11c8aeb069acd4cd0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab54A5CABBE7274D8A22EB58060AAB7623
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\cab54A5CABBE7274D8A22EB58060AAB7623
              • Size 822KB
              • SHA256 f4576ef2e843c282d2a932f7c55d71cc3fcbb35b0a17a0a640eb5f21731cc809
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Size 4.9MB
              • SHA256 7327d37634cc8e966342f478168b8850bea36a126d002c38c7438a7bd557c4ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x86
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\vcRuntimeAdditional_x86
              • Size 180KB
              • SHA256 be137dc2b1ec7e85ae7a003a09537d3706605e34059361404ea3110874895e3a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x86
              • Path C:\Windows\Temp\{4ADFC38D-9703-48AC-BD20-6A785BFF78D4}\vcRuntimeMinimum_x86
              • Size 180KB
              • SHA256 a2ad58d741be5d40af708e15bf0dd5e488187bf28f0b699d391a9ef96f899886
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\.ba\license.rtf
              • Size 9KB
              • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              thm.wxl
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\.ba\thm.wxl
              • Size 2KB
              • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thm.xml
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\.ba\thm.xml
              • Size 8KB
              • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 cc001c20f85e16015e0d23eb0c3a9bc3c3cdcc1adda53f88ac77dd29705ba01a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\cab5046A8AB272BF37297BB7928664C9503
              • Size 962KB
              • SHA256 8fafd6d0754ee53125902df1b67ef2db86eb7af4c097522f2fb58443501fecdd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\vcRuntimeAdditional_x64
              • Size 188KB
              • SHA256 7489cdde6a0c8aadb3253f22c460c2dc8099ba677f42d46b277f7040327c9b28
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{65473583-86E7-415C-9735-C1AF1A338DFA}\vcRuntimeMinimum_x64
              • Size 188KB
              • SHA256 e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2136-126-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2136-127-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
              Download

              memory/2136-2192-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2136-78-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
              Download

              memory/2136-69-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2136-2859-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2136-2845-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2136-1951-0x0000000000400000-0x0000000000765000-memory.dmp
              Download

              memory/2500-38-0x0000000000400000-0x0000000000664000-memory.dmp
              Download

              memory/2500-0-0x0000000000400000-0x0000000000664000-memory.dmp
              Download

              memory/2500-2871-0x0000000000400000-0x0000000000664000-memory.dmp
              Download

              memory/2512-42-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-27-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-39-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-41-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-37-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-36-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-35-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-34-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-33-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-32-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-31-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-2866-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-10-0x0000000000D80000-0x0000000000E1C000-memory.dmp
              Download

              memory/2512-9-0x00007FFB2F93F000-0x00007FFB2F940000-memory.dmp
              Download

              memory/2512-11-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-24-0x000000001F460000-0x000000001F988000-memory.dmp
              Download

              memory/2512-25-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-43-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-23-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2512-22-0x000000001ED60000-0x000000001EF22000-memory.dmp
              Download

              memory/2512-40-0x00007FFB2F7B0000-0x00007FFB30154000-memory.dmp
              Download

              memory/2764-68-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/2764-2860-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/2764-58-0x0000000000400000-0x0000000000543000-memory.dmp
              Download

              memory/3592-2850-0x000000006A370000-0x000000006A818000-memory.dmp
              Download

              memory/4540-2830-0x0000000000C70000-0x0000000000CE7000-memory.dmp
              Download

              memory/5100-2831-0x0000000000C70000-0x0000000000CE7000-memory.dmp
              Download

              memory/5100-2828-0x0000000000C70000-0x0000000000CE7000-memory.dmp
              Download

              memory/5660-2829-0x0000000000C70000-0x0000000000CE7000-memory.dmp
              Download