Overview

overview

10

Static

static

10

2026-08-21...os.exe

windows10-2004-x64

9

2026-08-21...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.1MB
  • Sample260821-e4js2agm5x
  • SHA256 3b25c11ee39426a417466db1b3ccd1d85c4279dda2a379dedc94dd9e3bc02f19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxyInstaller.exe" 1450711444 "Darkest Dungeon®"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1450711444 /silent /game_name="Darkest Dungeon®"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Users\Admin\AppData\Local\Temp\is-GZ6KTKVUK1.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-GZ6KTKVUK1.tmp\GalaxySetup.tmp" /SL5="$B01EE,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1450711444 /silent /game_name="Darkest Dungeon®"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:736
            • C:\Windows\Temp\{348797BA-69BC-4EE9-93E6-99FCBC91F162}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{348797BA-69BC-4EE9-93E6-99FCBC91F162}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x86.exe" -burn.filehandle.attached=696 -burn.filehandle.self=724 /install /quiet /norestart
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2760
              • C:\Windows\Temp\{01A3CE55-0982-48BD-8A25-36ADBA832C5A}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{01A3CE55-0982-48BD-8A25-36ADBA832C5A}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B166B88E-8C10-44BE-A61A-1011256C97EE} {C4A1AFE3-EBA6-4253-A8B5-B4056CEE14F1} 2760
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:332
          • C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4500
            • C:\Windows\Temp\{C909589F-D5A0-47A4-8CCC-9FFAB8D737A8}\.cr\vc_redist.x64.exe
              "C:\Windows\Temp\{C909589F-D5A0-47A4-8CCC-9FFAB8D737A8}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x64.exe" -burn.filehandle.attached=744 -burn.filehandle.self=748 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2012
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            PID:2116
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Suspicious behavior: AddClipboardFormatListener
            PID:3496
    • C:\Program Files\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1450711444
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe
        "C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4408 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1928
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3160
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1892
  • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2956
  • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
    "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:3968
  • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    PID:3716
  • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
    "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
    1⤵
    • Executes dropped EXE
    PID:1036

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GalaxyClient.exe
        • Path C:\Program Files\GOG Galaxy\GalaxyClient.exe
        • Size 14.7MB
        • SHA256 c6f63ae1cad0136b693863fb2582ab8a0c4f30b77efc597d2743c687a3f4f3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoData.dll
        • Path C:\Program Files\GOG Galaxy\PocoData.dll
        • Size 2.1MB
        • SHA256 970a5a0215dc51ee35f3e0ed3508feed50fa70b60fb9da27e9cdbc36ee500e99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoDataSQLite.dll
        • Path C:\Program Files\GOG Galaxy\PocoDataSQLite.dll
        • Size 404KB
        • SHA256 5fd3840b1464fce1bf95223a097c7a2c217389b5ca2cf893aec91741f3c4a6c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoFoundation.dll
        • Path C:\Program Files\GOG Galaxy\PocoFoundation.dll
        • Size 2.1MB
        • SHA256 dff145ef5117ffb273316685b4669220b0b31204f92be09e82691a73a9b955a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoJSON.dll
        • Path C:\Program Files\GOG Galaxy\PocoJSON.dll
        • Size 388KB
        • SHA256 45b48529aafda73c60959609910b18e34d198e7c898cace6969d907694d622a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoNet.dll
        • Path C:\Program Files\GOG Galaxy\PocoNet.dll
        • Size 1.5MB
        • SHA256 24b103f8e5ae714a5b41f697624b13211397fa72608375d4e5ff8aa35715aa98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoUtil.dll
        • Path C:\Program Files\GOG Galaxy\PocoUtil.dll
        • Size 595KB
        • SHA256 234111be57fbcae98f2eeae7b5b8340343a5529159f38b10799270932c28eca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoXml.dll
        • Path C:\Program Files\GOG Galaxy\PocoXml.dll
        • Size 605KB
        • SHA256 59f20cb65f18cc6b6ab3cfc0e8cdbee259354a244b90d5cd0aa7936b8048b0b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PocoZip.dll
        • Path C:\Program Files\GOG Galaxy\PocoZip.dll
        • Size 317KB
        • SHA256 8271d987a65a68ab6122bcceabaed0bcad4c05b8134a5f9c0290db711515a9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Program Files\GOG Galaxy\Qt6Core.dll
        • Size 6.1MB
        • SHA256 ee1ac4133cb8618f0154b497f31ab5916e02144833632b3c9e83f41bb2631026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Program Files\GOG Galaxy\Qt6Gui.dll
        • Size 8.3MB
        • SHA256 257be29c3263eae197bd666a34814874403e94a9f9659fe786811353ab597150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Network.dll
        • Path C:\Program Files\GOG Galaxy\Qt6Network.dll
        • Size 1.6MB
        • SHA256 e5dda85d26ce26d97dba94fcd8407989bd1dbfb4eaf9e2487ef5966b9fb942ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6QuickWidgets.dll
        • Path C:\Program Files\GOG Galaxy\Qt6QuickWidgets.dll
        • Size 115KB
        • SHA256 c9e74d33593834ab9c196cc2706752e3187aaa699eea0546c4ddb6ffe19bf922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6WebChannel.dll
        • Path C:\Program Files\GOG Galaxy\Qt6WebChannel.dll
        • Size 244KB
        • SHA256 9a7d3454c4a582130b6c6afd81e71902e23c56707838bcdd9342a6474a448867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6WebEngineWidgets.dll
        • Path C:\Program Files\GOG Galaxy\Qt6WebEngineWidgets.dll
        • Size 180KB
        • SHA256 6b94116ee0576c07ddd0966e2febbb983c925d136f45765abf3f45201d100e34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Program Files\GOG Galaxy\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 e1155224f31d54a7c79286b0f8014d1ffd70af187fb297a6ad29d3b8f75ee68b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1-x64.dll
        • Path C:\Program Files\GOG Galaxy\libcrypto-1_1-x64.dll
        • Size 3.3MB
        • SHA256 d357365d7f3eb7701fb8a24c76c51d9824e5b346989bb0cbc89e236bd87c40a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pcre2-8.dll
        • Path C:\Program Files\GOG Galaxy\pcre2-8.dll
        • Size 656KB
        • SHA256 de21d0943e658055b9eb0b32e8432056190e1c1dfd2604025092c69b9771ec96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-NJ1308ZA7U.tmp
        • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-NJ1308ZA7U.tmp
        • Size 18KB
        • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-VKJZTW7A78.tmp
        • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-VKJZTW7A78.tmp
        • Size 14B
        • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
        • MD5 SHA1 SHA512
        Submit Download

        sqlite.dll
        • Path C:\Program Files\GOG Galaxy\sqlite.dll
        • Size 1.1MB
        • SHA256 1875160d08be7a6bbe8989b1ba95738b2dffa3f444d5f2c93d8d797b9fc53da2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-HJT06KDWT5.tmp
        • Path C:\Program Files\GOG Galaxy\web\is-HJT06KDWT5.tmp
        • Size 27KB
        • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-TGZFJVTMEL.tmp
        • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\is-TGZFJVTMEL.tmp
        • Size 1KB
        • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        xdelta3.dll
        • Path C:\Program Files\GOG Galaxy\xdelta3.dll
        • Size 171KB
        • SHA256 01952a7e522f1e9caa2beccf9aaf930c312625a4565d6cfa35848ae6ae7fc6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Program Files\GOG Galaxy\zlib1.dll
        • Size 130KB
        • SHA256 1ac2cc7abd9449d8fd98a27f2c3d61f6e71cca8680183765c1e29cefa1cac44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-5BAW3K9U7U.tmp
        • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-5BAW3K9U7U.tmp
        • Size 54KB
        • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-JBQJBA4OBP.tmp
        • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-JBQJBA4OBP.tmp
        • Size 40KB
        • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\ProgramData\GOG.com\Galaxy\config.json
        • Size 76B
        • SHA256 2aefc577403ac70840f9b32ba520fa5a1878cbf48713d63e365bf33e4391bc61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.json
        • Path C:\ProgramData\GOG.com\Galaxy\config.json
        • Size 336B
        • SHA256 69601f552336ec1d8c57ccc2a74c7e1e997fd072d382e2b974d0f53d2c4c68e4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GalaxyClientService.log
        • Path C:\ProgramData\GOG.com\Galaxy\logs\GalaxyClientService.log
        • Size 17KB
        • SHA256 7d419f619db7a30b6e760413eb26a2f2c99ba5bc243b9189b1d4e612a0fbbfbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallerWebinstaller.log
        • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
        • Size 717B
        • SHA256 5b12ea330b636ce09d97ed9f5a281e7a360d9b9a8cef5447fdf5a59aaeb1ea8c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-5OWC9F5SRN.tmp
        • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-5OWC9F5SRN.tmp
        • Size 147KB
        • SHA256 1725e73ff0c952cdb0771da3424e6f119f65ca5700acec06c3b8bcf78406f959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f_000006
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\Cache_Data\f_000006
        • Size 312KB
        • SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CURRENT
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        TransportSecurity
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\TransportSecurity
        • Size 857B
        • SHA256 c4849b8d8ce4070248e13e37d6a3d7945b6d382429ed52dc2cae957db12d7289
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TransportSecurity
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\TransportSecurity
        • Size 857B
        • SHA256 4c0660fba15102ded12a1fedf4267805715a86d9a81e06839fb70f64eb2fddfa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TransportSecurity~RFe5a63dc.TMP
        • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\TransportSecurity~RFe5a63dc.TMP
        • Size 857B
        • SHA256 0f0118b2f21f2064ef3232b94728284e490ebe6c428b062dc4b37905de934085
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
        • Size 2KB
        • SHA256 c3d3588297ef6b8cf1a16d0f5231f3a74068ee43bd0e45557355d10fcd2461d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
        • Size 2KB
        • SHA256 1133c21dc8a6f4bd34ae1796220bb0583313a3c7df3956c98f01ecd99f2718cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GalaxyInstaller.exe
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\GalaxyInstaller.exe
        • Size 120KB
        • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\icon.ico
        • Size 111KB
        • SHA256 713aff4b88b1e35c899b216e8694d9cc8eae6d66d3f6d9227b738fffdb1ddeff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        remoteconfig.json
        • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_RqjQc\remoteconfig.json
        • Size 529B
        • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isdecmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\_isetup\_isdecmp.dll
        • Size 27KB
        • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vc_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x64.exe
        • Size 17.9MB
        • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vc_redist.x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-FLZ0SMAGQV.tmp\vc_redist.x86.exe
        • Size 6.7MB
        • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GalaxySetup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-GZ6KTKVUK1.tmp\GalaxySetup.tmp
        • Size 7.0MB
        • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{01A3CE55-0982-48BD-8A25-36ADBA832C5A}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{01A3CE55-0982-48BD-8A25-36ADBA832C5A}\.ba\wixstdba.dll
        • Size 215KB
        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vc_redist.x86.exe
        • Path C:\Windows\Temp\{348797BA-69BC-4EE9-93E6-99FCBC91F162}\.cr\vc_redist.x86.exe
        • Size 668KB
        • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vc_redist.x64.exe
        • Path C:\Windows\Temp\{C909589F-D5A0-47A4-8CCC-9FFAB8D737A8}\.cr\vc_redist.x64.exe
        • Size 669KB
        • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1036-2845-0x000001F99DEC0000-0x000001F99DF67000-memory.dmp
        Download

        memory/1036-2827-0x000001F99DEC0000-0x000001F99DF67000-memory.dmp
        Download

        memory/1928-2771-0x00007FFDA86F0000-0x00007FFDA86F1000-memory.dmp
        Download

        memory/1928-2772-0x00007FFDA8700000-0x00007FFDA8701000-memory.dmp
        Download

        memory/1928-2773-0x00007FFD87E40000-0x00007FFD883C4000-memory.dmp
        Download

        memory/1928-2830-0x000001AFCBEB0000-0x000001AFCBF1B000-memory.dmp
        Download

        memory/2116-2231-0x00007FFD6E3D0000-0x00007FFD6F3D0000-memory.dmp
        Download

        memory/2116-2229-0x00007FFD81720000-0x00007FFD81D67000-memory.dmp
        Download

        memory/2116-2232-0x00007FFD7E250000-0x00007FFD7E7D4000-memory.dmp
        Download

        memory/2116-2230-0x00007FFD7E250000-0x00007FFD7E7D4000-memory.dmp
        Download

        memory/3424-2745-0x00007FFD89C40000-0x00007FFD8A287000-memory.dmp
        Download

        memory/3496-2722-0x00007FFD818E0000-0x00007FFD81F27000-memory.dmp
        Download

        memory/3496-2725-0x00007FFD7E250000-0x00007FFD7E7D4000-memory.dmp
        Download

        memory/3496-2723-0x00007FFD7E250000-0x00007FFD7E7D4000-memory.dmp
        Download

        memory/3564-1-0x0000000000400000-0x000000000051E000-memory.dmp
        Download

        memory/3564-0-0x0000000000400000-0x000000000051E000-memory.dmp
        Download

        memory/3564-2751-0x0000000000400000-0x000000000051E000-memory.dmp
        Download

        memory/3904-10-0x0000000000060000-0x0000000000080000-memory.dmp
        Download

        memory/3904-328-0x000000001BB30000-0x000000001BB40000-memory.dmp
        Download

        memory/3904-23-0x000000001E8C0000-0x000000001EDE8000-memory.dmp
        Download

        memory/3904-22-0x000000001E1C0000-0x000000001E382000-memory.dmp
        Download

        memory/3904-27-0x000000001BB30000-0x000000001BB40000-memory.dmp
        Download

        memory/3904-30-0x000000001BB30000-0x000000001BB40000-memory.dmp
        Download

        memory/3904-11-0x000000001BB30000-0x000000001BB40000-memory.dmp
        Download

        memory/4148-2738-0x0000000000480000-0x000000000064B000-memory.dmp
        Download

        memory/4148-46-0x0000000000480000-0x000000000064B000-memory.dmp
        Download

        memory/4148-581-0x0000000000480000-0x000000000064B000-memory.dmp
        Download

        memory/4952-2735-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download

        memory/4952-2235-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download

        memory/4952-582-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download

        memory/4952-2072-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download

        memory/4952-2030-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download

        memory/4952-2737-0x0000000000E40000-0x000000000154D000-memory.dmp
        Download