fda06862da96e7d3738cd7952bc53ee8e010a78cc9345c3bec8a4e0abbe0a24f

Analysis

user interaction
yes
max time kernel
286s
max time network
345s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_dome_keeper_4.2.3_(81250).exe
Size 817.1MB
Sample260717-vbge7sbw81
SHA256 fda06862da96e7d3738cd7952bc53ee8e010a78cc9345c3bec8a4e0abbe0a24f
MD5 a926940ed0da5e0d1c064fc29f7ef594
SHA1 9c66b5b901dada61f243366c1437fda0e30eea70
SHA512 727999863e44d349bddd77770964580d75f7f5bc1a25b304b3f9ea9f21e930d7f00cf7a3d25829c9bcf7e19fec3be386e675fbf38a8868783b214b294b7b49d9
SSDEEP 25165824:9wGtvkTjxNPIE/5lFloimHGRJIH/DrVwpW:9vMTjDPr/5OXPfPVj
TLSH
T19B9933CCB4F666FDBD75A1B7BAB6E48463E410AB8087C837643C83DC05C3B6197A1946
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1128	setup_dome_keeper_4.2.3_(81250).tmp
900	scriptInterpreter.exe
5036	scriptInterpreter.tmp
5084	domekeeper.exe

Loads dropped DLL 13 IoCs

pid	Process
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
5036	scriptInterpreter.tmp
5036	scriptInterpreter.tmp
5036	scriptInterpreter.tmp
5084	domekeeper.exe
5084	domekeeper.exe
5084	domekeeper.exe
5084	domekeeper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_dome_keeper_4.2.3_(81250).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scriptInterpreter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scriptInterpreter.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_dome_keeper_4.2.3_(81250).exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2756-0-0x0000000000800000-0x0000000000839000-memory.dmp	innosetup
behavioral2/memory/2756-168-0x0000000000800000-0x0000000000839000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c513-651.dat	innosetup
behavioral2/memory/900-655-0x0000000000F50000-0x0000000000F89000-memory.dmp	innosetup
behavioral2/memory/900-700-0x0000000000F50000-0x0000000000F89000-memory.dmp	innosetup
behavioral2/memory/2756-734-0x0000000000800000-0x0000000000839000-memory.dmp	innosetup

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	setup_dome_keeper_4.2.3_(81250).tmp

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup_dome_keeper_4.2.3_(81250).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	setup_dome_keeper_4.2.3_(81250).tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	setup_dome_keeper_4.2.3_(81250).tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup_dome_keeper_4.2.3_(81250).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	setup_dome_keeper_4.2.3_(81250).tmp
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\NotificationData	setup_dome_keeper_4.2.3_(81250).tmp

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
5036	scriptInterpreter.tmp
5036	scriptInterpreter.tmp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1128	setup_dome_keeper_4.2.3_(81250).tmp
5036	scriptInterpreter.tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
1128	setup_dome_keeper_4.2.3_(81250).tmp
5084	domekeeper.exe
5084	domekeeper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1128	2756	setup_dome_keeper_4.2.3_(81250).exe	86
PID 1128 wrote to memory of 900	1128	setup_dome_keeper_4.2.3_(81250).tmp	90
PID 900 wrote to memory of 5036	900	scriptInterpreter.exe	91
PID 1128 wrote to memory of 5084	1128	setup_dome_keeper_4.2.3_(81250).tmp	93

C:\Users\Admin\AppData\Local\Temp\setup_dome_keeper_4.2.3_(81250).exe
"C:\Users\Admin\AppData\Local\Temp\setup_dome_keeper_4.2.3_(81250).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\is-BFD3D.tmp\setup_dome_keeper_4.2.3_(81250).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BFD3D.tmp\setup_dome_keeper_4.2.3_(81250).tmp" /SL5="$400A0,856228567,192512,C:\Users\Admin\AppData\Local\Temp\setup_dome_keeper_4.2.3_(81250).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\GOG Games\Dome Keeper\__redist\ISI\scriptInterpreter.exe
    "C:\GOG Games\Dome Keeper\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Dome Keeper\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Dome Keeper" /productId="1635627436" /buildId="58522737328629293" /versionName="4.2.3" /Language="English" /LANG="english"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\is-2GQO5.tmp\scriptInterpreter.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2GQO5.tmp\scriptInterpreter.tmp" /SL5="$602DC,662929,192512,C:\GOG Games\Dome Keeper\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Dome Keeper\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Dome Keeper" /productId="1635627436" /buildId="58522737328629293" /versionName="4.2.3" /Language="English" /LANG="english"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:5036
- - C:\GOG Games\Dome Keeper\domekeeper.exe
    "C:\GOG Games\Dome Keeper\domekeeper.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Galaxy64.dll

Path C:\GOG Games\Dome Keeper\Galaxy64.dll
Size 13.7MB
SHA256 9a45c55d622585ec6b72bf33c5ac322f2ccc1de2ff785ac1fc1230bd90c847d0
MD5 a0af88d0023dd5908e71396e13fa1bdb
SHA1 a057d34da52edbbd3b883995adfcaee7d4670970
SHA512 da902964a6a524929546ac8b86616eecb061e03c881f61c418a7c93c0238e9b4568ed7dae1aa9c5c03fd3dc6c8983948c647a00bc714aaa575ce908488db3d50
SSDEEP 393216:pK0Bv87Uh1IUHnxIZeR+f0N2of/mSZI4HLSEGW8uzkmgNfIu/fymopM1iiJ6VdDJ:plBv8I7ZF
TLSH
T147E67D6632AC0185E0B7C0BDDA8B4B07EBB234460771CBDF016186AE1E67FE95E7D611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptinterpreter.exe

Path C:\GOG Games\Dome Keeper\__redist\ISI\scriptinterpreter.exe
Size 1.2MB
SHA256 d8667e94d5a9fe2d81e04df7e38f792bcf37aa727c24787014a51bd77fb19c65
MD5 c8aaca5f97815ab662436e5449aed17e
SHA1 4e47cbf558a813d102aee87284c404a02274eb0a
SHA512 50e16042834a7ee6bd30b471142d17e526419b325c45b1f945323a01d773833a7011d9a820594515114043c06b6cfbebd7948778a6f6f6883b44680c13535f97
SSDEEP 24576:cxct1NCeJqKhWXQ7CwloeLyZ6bUZ/LqvKUmCOyEGJPV:Yig8MQpoeLyXZ/uvKoO6JPV
TLSH
T193452202F3C34072F4A54E79C466C5002C1BBAFD09F6A55A2DBCF50D1AB6BC1AC76B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastlzwcompressor.windows.template_release.x86_64.dll

Path C:\GOG Games\Dome Keeper\fastlzwcompressor.windows.template_release.x86_64.dll
Size 332KB
SHA256 cc43c63f3d4e77da3886e83ec51c107f4d3b89dfdbdd6116a48dd3a63cd249c6
MD5 d8a9e521b546db1d7d1eb591f95460d6
SHA1 f5ff00b6e01aa6af8ebce8d94eda6c2cfca00725
SHA512 7bb27f969145b9328a24a13b5fda988ce53e8b581d85b5e03ff94e5defd0666830fbe3ade521b3f24ec4d11518821cf11bdbe27c414cdbe10da09c04fbc877af
SSDEEP 6144:aIccg0QSrPYj9GeNkpt2LoSTp5k2vHDDwRzzfwo+h9ytskI:hg0QSqZypt2LBM2Xwtzoop
TLSH
T1AA746C19A34066F9E433A138C6975901E6F63DC003705DBB23AA46199F33FDA5B3EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goggame-1635627436.info

Path C:\GOG Games\Dome Keeper\goggame-1635627436.info
Size 514B
SHA256 83cceffd6519355f884cd8e3d9881dbe1d0dbb4f3b7f0fa208896e63f0e9e003
MD5 d950eafbb482ac36c1fc898ac9d5dedd
SHA1 c4e58212c6c0eefae23e57bd974ca12a2784b2ce
SHA512 1410506e6b884c54760e9f2ff6fbd6fb833c5f05b16e0832ac112f73dd8621a81408de183898fbc4a8b8198275d9d31f7f953b8ae63c71c8d6a2d6e94ddf8fbd
TLSH
T1A0F0223CC8291C972898016020BC5983AA6048930F897E2473CC641EAF8E40F19BADDE
MD5 SHA1 SHA512 TLSH

Submit Download

libgodotsteam.windows.template_release.x86_64.dll

Path C:\GOG Games\Dome Keeper\libgodotsteam.windows.template_release.x86_64.dll
Size 2.3MB
SHA256 2ce89535aeab2e08d3ebce2f97f6381b49b727133036ccaeeb94ca403683ddcd
MD5 f113ebc91241880f963db222cd0d8861
SHA1 6ee1563b6ad06005382371521c4dd4bf7c6c6564
SHA512 0bc935be107747b4c2f4ec9b6a222b852540fc9a108d18c997f067200bc063671c4a046a4c187796f2a6908266e4e259a1d880409a1e7df5a7a88ae69a894436
SSDEEP 49152:v1UvH7QkrIvflvhL1Taf69hjS/bbYR4PYhU00BrkdtqkCAYuuSiSJxSkLfQ5h/cT:AFmMu3a4Zv
TLSH
T127B5091EA73402B9E112D0BECA935616E5B1381DC335B6F70ED3AE564F273D4913AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\GOG Games\Dome Keeper\steam_api64.dll
Size 2.6MB
SHA256 212efeecd460ddf9be50b3752d0f0f008b05ac61aa5f7b3472f34acbdcee899c
MD5 812ffea2432afee4b8452358e10a6de0
SHA1 b8b84a54a0d7416b3c73b2af75dc1eee5c1f58cf
SHA512 5990bfdfcf5b4def910b80bf05c8eed8cf73394ba716c210ac26928f62af83f8c2cace8426ea67f9415ccd5157026f5e4511085d22880c49a0689c3f6b3c5a5d
SSDEEP 49152:fz6n3M4X1NZapTvkDDUCSTXHLkgvYWyrM2C:fGpuTvygCl
TLSH
T1E7C51A2A266801B5D17FD0BCCA430F0BE660B00753715EFF64A446AE5E67BD51B3AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path C:\GOG Games\Dome Keeper\unins000.dat
Size 377KB
SHA256 f7af7fd0907954dccb8a1e1535b2e35abe032eb6140c66baaf6f2788bbf43c98
MD5 45e6b857a4f1f413faf0d04a5569f766
SHA1 524cbaf7054b9c0382b7b278a7e68a4e57d90740
SHA512 c68884f1a742c84d107655e9b702adfb2ef3fdc41b78e39eed997b449423d9d17fadbf53754ed64b054f382ee2988784767118f42bddb70adb9d5af35edebede
SSDEEP 3072:hIi6p20EKXNkCJ7uR4gZbhY/v2rJmoMoK+oa/X7DFSBdS0:v6poS29W
TLSH
T1D384DF0DBAECAE21C37DF638DDBB1504332EBE006A46C30A1BD5DA5B984B95D8D53325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\GOG Games\Dome Keeper\unins000.exe
Size 1.3MB
SHA256 f0561641154d3ce726ad9f04b4b1ee98c2bfbb211d1276eb6ba3e27d905c7101
MD5 c61b0d0fe0a799a2d1274dfa2cb255fc
SHA1 a495af04d4ddb77b235cfb1ca08b8dedfdb69883
SHA512 327c5024b6626f3e30f955b3bdc411bb4d38075e2e17e605cec3d0cea0183dbb9c4b8075e3d23c0b8d9a19dff1088c8e523f337ff86d3ec1458c191027d82a93
SSDEEP 24576:PgNfn7OOXeL7dJ/oOP9pjA0fY2Mqz9JT7ytfsxjHElkLD229Oqkipt1NCnqxjVh:4tTX6THjACMq/xCaaMksgi/
TLSH
T12C552922A3E18437E1732F795D3A96945C3A7D202EB4E44E7EB89E4C0E35B417D39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptInterpreter.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2GQO5.tmp\scriptInterpreter.tmp
Size 1.3MB
SHA256 5761e7789d813626cd68ee1e62429cfeb92bdd814cd29ef12fc4ae9ec1dbaff3
MD5 01190d8b6805fd4d2a68750fbd041966
SHA1 c5c967d47cc57112eec5fe7db0229b36e22ec661
SHA512 c079f1674f800bbcfe97d95e596314ba9f74bc7f87433dede4da91978c9ba9b1f0b22a4b690a07171983c46ac35e523a52df143072f700279914279de133957d
SSDEEP 24576:pgNfn7OOXeL7dJ/oOP9pjA0fY2Mqz9JT7ytfsxjHElkLD229Oqkipt1NCnqxjV0:6tTX6THjACMq/xCaaMksgiC
TLSH
T1F8554A22A3D18437D4732F795D2AD6946C3A7E202EA4E44E7EF89E4C0E35B417D39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1207658754_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\1207658754_english.jpg
Size 166KB
SHA256 c1127b4457b5ea3870b22557003434f3d71fa3b4f0ccf65d4a942510b8877791
MD5 4c45be6c33ea4f46b846a67f0809f3c0
SHA1 ceb530c0a1915fe8e740d08d0e1b833b10d5b54b
SHA512 b0494a57263f1e7808dd280ceaeeb224fbcc0863cfa6ac10b13da116cf668748c000a10ee9d5a0e7adf3e2195748e6dbc2103e75dddea9bf560bf615799b3058
SSDEEP 3072:bRRXmirbmZOnOiA0eQlso/ruqw7THqOQ/t8ZlMjifXPJhSNmeQBGfgZy:FRXmiOBifeQd/KZu2TMjivP2Ekcy
TLSH
T163F3125AA8754BD68ACCEECDF58B86EC4EE29B58F1C95FC72E58030C376840311D52B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1207660863_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\1207660863_english.jpg
Size 172KB
SHA256 a39dd1092d9622824c0732bca9b409884f17b103cfd9ba46d30b4abb75c61233
MD5 3f77ddf39aefe5244f320e5543657cac
SHA1 e8f15c51d79865b15e25899203d537bebc899ca8
SHA512 a0e667fa4ad4db718835442a18676b22e234bc5df07a5b2830fe72a2b06109a0a54963fe161b5b8a42a8ee13d21f8fd159e17e9ff6df3702d576875680e9d0ba
SSDEEP 3072:i5CEQkCgWUv7xrBOHukj0GhIx5UzR+6fEE9nOJPl1I6/f+h:i5tQ/OjxVOHPj0GaUzJ8EROJt1FWh
TLSH
T138041221DC9B0663257DE73E50D55C31835C4B8AD9A023DD0C764CCBBA8A986DE07EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1207662143_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\1207662143_english.jpg
Size 177KB
SHA256 15e993e8e8674c4ab866a53c1abc00be6acd7e2d898b6f7eee65f744d2645618
MD5 de5d59eb9ad9f709e9f8431697bab09d
SHA1 9773ed3553d0b9d7cd026c78e9abf264224d1356
SHA512 0f05c9eb1eb2fa242ad4b67b1e3cc01ec3f066924527da376a385938718398fc85ff1e9a714d9378be070c9ede785ab41fb6d69797e62b00b4f344e8721f14af
SSDEEP 3072:FhwV544YxUO+jDAVZUaanhBT8ySx3cP5s5cziOviJlwXeLXtO7ubE4:knvYxDxVZHahtN5P5sKziOAwubgM5
TLSH
T16204123BD7667CE71366E36D3F5524CEC7B91A403A54B2C180A382EBBB3A850781C59C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1207667113_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\1207667113_english.jpg
Size 196KB
SHA256 812127e3ff506f53731a009c1ae6e30218bd98ea95305d07fcadafebe118279c
MD5 9f9dc26a2b7e01c56fd6b0c9a4bf46d0
SHA1 6a3680237e69ed2f04a5446c557eccced14edf8a
SHA512 90d5cf57228e970d0b784062c904e6416f526a8c8128f782cc8f805fec2f32d5a30311add77e4407aeea53d761915eccc1946e23a1b066095ad9aa2296c025da
SSDEEP 6144:v2n4x/0EVbi2CsR8vnNKvsg+nX5nlyb+72z:NBdi2RQNKvs1Jnlyb+yz
TLSH
T16D141234EC3C07674FE8373C856BAE7D625E111A49909BC81A3B6D451A4673B8CC36EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1432213513_english.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\1432213513_english.jpg
Size 188KB
SHA256 b80830d6cf1454bfaedb224da7e1a1f9935b6411ca72cdce074009e0c128cd4b
MD5 dabd1f5a7b5b6d5f3265edb273bb1077
SHA1 1d1d25fc87e9bc25039e223d58fb9cde63a75eb4
SHA512 6bafee2fa1fe5b103814e67ed0cffee251cbf94a5f4add01ee692ae1e07aa727dd172c3a0dd30005fa24d7ef77817623b18756b017fa17a8a125beb786367d37
SSDEEP 3072:7ump8GkHQj0SkQVU2TpamvUEcqqMLF697/nkCbZpY0UwaFwQZWmsaYr:7xPAPQV1WMLF69vbjYLBFrTYr
TLSH
T18514129BEE9C210856D9D3B93DA46C8D39D2A66C9D1E463F12471FD80CECAD18C890DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BigOK.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\BigOK.png
Size 3KB
SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
MD5 5b43a5d975a53f4fc1da67ce9f7784c1
SHA1 8543fa1e471030049942252b23cb22e0880c3af5
SHA512 5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5
TLSH
T17B614DD1323C683EC7F40B2CA1881A5EC1AB1340654B66A852CF64580798A79B77A777
MD5 SHA1 SHA512 TLSH

Submit Download

EULAAccepted.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\EULAAccepted.png
Size 2KB
SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
MD5 461dfeb75927bdb39f9db5348612a611
SHA1 b7893b1fff6801e37ee7337d876962a09184941e
SHA512 68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b
TLSH
T1BC512BEFF5921C02C255B8E918E9A6939EE5C9C58DD1542578CFC08B14794B4006A2CF
MD5 SHA1 SHA512 TLSH

Submit Download

EULAShow.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\EULAShow.png
Size 1KB
SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
MD5 c596bc9111edc702bbbb29b70984254f
SHA1 d4712c7b91ff4f8994e7907d31357c42eb47c738
SHA512 db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a
TLSH
T19C31B5C9F640B801C245ECD028E9A4328D7E9D805AE1BDA9F8CFE4C745365F8142C1CB
MD5 SHA1 SHA512 TLSH

Submit Download

GOG_new.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\GOG_new.png
Size 3KB
SHA256 0804b385c1736e009fe8c3b1b14085b9b9abb40ce487360002ab4a8f3505f4e0
MD5 d5b63bdfa47ef5954917c148bacf7b13
SHA1 5302c6715d9e9b5d2768b130f3e516e175684cc9
SHA512 b5cde681be9ad1c1211559dc4b363003bf547e8dc965dbb9560fdddfc28ee1d8f27cc534dd00864d800fd351c48694d7dc8df55fc3d8d69acf8b702c7b421aa9
TLSH
T131814D84F3887DD8825945050CF7A73BF64B1BF0B092E04A64CECE9B093236E955C09A
MD5 SHA1 SHA512 TLSH

Submit Download

background.jpg

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\background.jpg
Size 279KB
SHA256 06e2aa5dcddf8fb07b260332d18c819d458f74974df2edc34193dfb680da3382
MD5 328b4345c3adf20414ea9c9df9b13d42
SHA1 5de8632c1a0ead8ed6f4f7b798a765d1f6a20e43
SHA512 efa4eb9a2306ad353f76446df0e2af7aaaaabb481290b57b1c1ae9465660f8abca83d6b44947854ac4534ca3b30aae9f92123b52d78f393efdaf063b26d1ecdb
SSDEEP 6144:1J7lDRT12KW5sgko4YX5XPpeSNYyteScb+Rud:1plDWKWqgkJUdMSS+Ry
TLSH
T15854F253CF210B959DAD42E1EE478EED0F422F4CB49528EF0242EB8BB533657958D0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btn_md5.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\btn_md5.png
Size 8KB
SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
MD5 3befe9739354ee24a0b1ea8df05ce274
SHA1 ab0bda986a8c46aa19f57b75a2b7b22445a3c625
SHA512 ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd
SSDEEP 192:+CgAPOTLq6/bkYNuQJA6hcxuGcjMTch2kmBm/5o:+IPOTLq6oAANOjTh2kmE/S
TLSH
T119029FD4E3E5CD10C688BB8B1DCA8526E80C1593E7A6C7C2F536E4029A3327826D97C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crcdll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\crcdll.dll
Size 69KB
SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
MD5 1d51fac9e2384eeb674199cfd5281d7d
SHA1 861dfdc121357d605d0cc3793266713788109eb2
SHA512 921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda
SSDEEP 768:tCrczqrdE7n1KuGUlKTs3RLflC7ZWL/sebzx7jMKkkg8dODMh1MK/N58n:tCrczqJ8U5s3R7lYZWbzx7jPgRE5
TLSH
T1EC637C207951D176C08A6835551AC3B11A7DB8322AF9C983BF971B7E9F203D1F63B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\error.png
Size 726B
SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
MD5 df10adc25b673e74e19971c17bee5a98
SHA1 ee16fb1cf9491f5e611282f0574b27d76fede412
SHA512 dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f
TLSH
T11401946FF800FAA8AD7A1DDA97752550C4FE877D66A200D0B4D2C44831822680F17789
MD5 SHA1 SHA512 TLSH

Submit Download

error_icon.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\error_icon.png
Size 1KB
SHA256 acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8
MD5 263720c4b8bb111567a2a49989b8f467
SHA1 cf346fa3c70164648e0eaf72a37c6f4920ab4792
SHA512 94f06a81dc735cf264abde86e6169e5fd78d873d2e926fd48287d2ac5208fc930c3c432186e3510add002bd1b4ae32ad8d35270b17c3ce5f18c43764a8e9de43
TLSH
T1AE319986F6811401DB18849211D640368F674540E9E8E1B6B6DFCC434A703FE669BBCB
MD5 SHA1 SHA512 TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ok.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\ok.png
Size 1KB
SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
MD5 103c1368e60806b1b7995a0894eacf87
SHA1 971392527f6e4b655044773132505c901a6b5469
SHA512 652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a
TLSH
T10A21B7FC167568EA76B543B9428B0D65C9BAEE2D640D730AB076CCB45C43491C6DCF60
MD5 SHA1 SHA512 TLSH

Submit Download

progress_center.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\progress_center.png
Size 1KB
SHA256 2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43
MD5 ad7fc1e37e40da38dd57adc446cc6c0e
SHA1 08033265deb9b45243cfa0065d98ffe13a039e26
SHA512 dd715d74f8e1ed6ab75b7b6530b383ac47040d8baa7728be160f6d230bf485a9cc54f15f7dc85b122ce56e54d63fa4890e510dfc89d9c9344e31f789ebac8756
TLSH
T16321634AF9446C82628ED19238FA542B592EC941E9F4E865BCEEC88B05383F855294D7
MD5 SHA1 SHA512 TLSH

Submit Download

progress_left.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\progress_left.png
Size 1KB
SHA256 85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668
MD5 290c7612ad7a077028cd3dc78ce99673
SHA1 18995fbe39d05e4a1cafc7cc2e0f6fb745442f77
SHA512 799841f5b8a1056e78a49c823009750e4b93af130a6c4ff9dc6d386c06b88614e53b46a6df62f5a217d5c99da01cf4e2fe8392c73d39e81000045291cf24205a
TLSH
T1E121744EFA106C41628DE5C638FA4427991A8400D9F0E951E9DEC85B09303F9656E0E7
MD5 SHA1 SHA512 TLSH

Submit Download

progress_right.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\progress_right.png
Size 1KB
SHA256 396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d
MD5 c25a41f022a74308d944d1e807d72f44
SHA1 83c6bbec3fb373fcc78ce0e737742100994cd6d4
SHA512 d2f4449195f3e60c826cfabb52a083d829eb9d0509272977d8fdb33bc5214678949cd27d0594684594e0a3eda2351c39cec8d91923cb716ad144ccf2b966c8e6
TLSH
T15421AA5DF6006C41569DD08238FA54639A0F8840C9F4F551FEDED85B04323F9645D0D7
MD5 SHA1 SHA512 TLSH

Submit Download

slideshow.ini

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\slideshow.ini
Size 674B
SHA256 c27bf5bbbb0833d9c59f25fc8c97cd503a95c2c5bea72242317b550525d028e1
MD5 d49fd60ae4e95ebfa09185b49e343944
SHA1 1491412cb664b6ddd63b139156736d42ebf44221
SHA512 dd151fa0e780ea5e7a24dd67b3faf4220e12deabaf8f182af2ccfbbfcbd08c5bddcb4bfbdbb10b870c0c9bc287b30dda2c3a6c13de155c457790553f158160ed
TLSH
T1A2012BAB050B649FFFF0E7602922A9C969E5351849D2E0A8F356825D05E12335C1F4AD
MD5 SHA1 SHA512 TLSH

Submit Download

track_center.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\track_center.png
Size 1KB
SHA256 794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860
MD5 3f2b0c22f8ea28dcbb82b39a16a039aa
SHA1 b3f4dfc2ea86fbdad05877b4c356b7fa8016731d
SHA512 b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3
TLSH
T181216046FE005C01718AE6D228FB8432952A8480E9F4F460BADEDC5B47353F8492E1DB
MD5 SHA1 SHA512 TLSH

Submit Download

track_left.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\track_left.png
Size 1KB
SHA256 a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8
MD5 55dacb00cbe2825a8540236c5777a205
SHA1 18a52ac6c741b558500fbc1716d46b4fe4471982
SHA512 2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10
TLSH
T14D21968AFA409802B1CAD45328FB80379A198400DDF4E561B8DFDC8B05657F9892C1D7
MD5 SHA1 SHA512 TLSH

Submit Download

track_right.png

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\track_right.png
Size 1KB
SHA256 f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16
MD5 ddec70b6c49be3e8c3a7d01c2f6ff1c5
SHA1 5383271999f787c36b1dc8f3cc13c8407b195439
SHA512 f43f94b194b5a7eafcec9e831f61042859c30e1af2e2447195bdd06b12c90982181161a1c1be5aa5223ff664f88e4891bd71cfffb7ef672d6fe4f614030e0e01
TLSH
T1D2216349FA40580276CAE5923CFA90339A998580CEF8F1B379DEC86B05363B5465C4EB
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5EUSQ.tmp\uninstall.dll
Size 691KB
SHA256 cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0
MD5 7db706c324cc9b6fda497d081eed6e26
SHA1 ca97392e573af0cf61bfa3301801a85f2beea44c
SHA512 8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19
SSDEEP 12288:9YKdxak+D9/RPZ3GrBBIgk19USw7dffODcHCG0OMnaTVW/Rt888888888888W88c:iea1D9jgBBIz+ZDiG0BaTVW/
TLSH
T1A7E48E22B3D24437E1731A359C6B92655C267F252EE4A54A2FF8EE4C0F7D68138353A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_dome_keeper_4.2.3_(81250).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BFD3D.tmp\setup_dome_keeper_4.2.3_(81250).tmp
Size 1.3MB
SHA256 abf8d4d522ca94a179d644ec0464474b580ec82441b118b663da3bd879f91d85
MD5 ff5ebf66cddd9913b729de78eeb638c8
SHA1 ca23d5639d1c516e3defc8f5b267bb5c040238d5
SHA512 4fa3a2dc8ad68bfffc0e039171d2da71c3c37eade709d5495e825bb53f576180eafee57e3c1f78d7dcc8d26e26cc24e1e99bb494d9b4a55f74f4145eb6e5a05b
SSDEEP 24576:HgNfn7OOXeL7dJ/oOP9pjA0fY2Mqz9JT7ytfsxjHElkLD229Oqkipt1NCnqxjVV:AtTX6THjACMq/xCaaMksgi7
TLSH
T1B3554A22A3D18437D0732F795D2BD6946C3A7E202EA4A44E7EF89E4C1E35B417D39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-G5OC5.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.dll

Path C:\Users\Admin\AppData\Local\Temp\is-G5OC5.tmp\uninstall.dll
Size 712KB
SHA256 d88bcf910e7a5ce4d76ca48b263ef226911b455d3a8db80c9fa69aeb2b3898a1
MD5 f3a88277fc7e0c057c40e47a7e43f9ad
SHA1 78ae0052b323139a4de7a5361a40503a39339f4c
SHA512 3c40377600fbb814fe19423404d2fb29f6342ab2a3a6d5dc50f42086fc0f59174184a0870d7f04fb6ee5f84828e1ed282396bfcb70842084af25f5af15cc8a1f
SSDEEP 12288:S5buPksTwKAZ1BVcvDEmwQT9KT/whp90r2pYZnaTmH7BR888888888888W88888j:OmzEKAXMvDECaY50r2pMaTmb9
TLSH
T1ABF47D22A3D24437D1731B354C6B96A95D2A7F252EE8944A2FF8EE4C0F7978138391D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-655-0x0000000000F50000-0x0000000000F89000-memory.dmp

Download

memory/900-700-0x0000000000F50000-0x0000000000F89000-memory.dmp

Download

memory/1128-424-0x0000000006420000-0x00000000064D7000-memory.dmp

Download

memory/1128-552-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-191-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-192-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-186-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-265-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-293-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-325-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-359-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-391-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-420-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-421-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-426-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-181-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-425-0x0000000006650000-0x000000000665E000-memory.dmp

Download

memory/1128-452-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-455-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-479-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-491-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-499-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-502-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-503-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-514-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-513-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-522-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-523-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-529-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-532-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-540-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-550-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-555-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-551-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-553-0x0000000006420000-0x00000000064D7000-memory.dmp

Download

memory/1128-212-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-562-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-570-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-577-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-586-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-595-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-604-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-607-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-643-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-646-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-180-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-174-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-177-0x0000000006650000-0x000000000665E000-memory.dmp

Download

memory/1128-175-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-171-0x0000000006420000-0x00000000064D7000-memory.dmp

Download

memory/1128-170-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-675-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-6-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/1128-169-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-172-0x0000000006650000-0x000000000665E000-memory.dmp

Download

memory/1128-697-0x0000000003C90000-0x0000000003D90000-memory.dmp

Download

memory/1128-15-0x0000000006420000-0x00000000064D7000-memory.dmp

Download

memory/1128-733-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-708-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1128-707-0x0000000000740000-0x0000000000892000-memory.dmp

Download

memory/1128-709-0x0000000006420000-0x00000000064D7000-memory.dmp

Download

memory/1128-710-0x0000000006650000-0x000000000665E000-memory.dmp

Download

memory/1128-60-0x0000000006650000-0x000000000665E000-memory.dmp

Download

memory/1128-167-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/1128-166-0x0000000003D90000-0x0000000003D91000-memory.dmp

Download

memory/2756-0-0x0000000000800000-0x0000000000839000-memory.dmp

Download

memory/2756-168-0x0000000000800000-0x0000000000839000-memory.dmp

Download

memory/2756-734-0x0000000000800000-0x0000000000839000-memory.dmp

Download

memory/5036-699-0x0000000000C20000-0x0000000000D72000-memory.dmp

Download

memory/5036-671-0x0000000003430000-0x00000000034EB000-memory.dmp

Download