Overview

overview

10

Static

static

10

2026-08-21...os.exe

windows10-2004-x64

9

2026-08-21...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    127s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.1MB
  • Sample260821-e4js2agm5x
  • SHA256 3b25c11ee39426a417466db1b3ccd1d85c4279dda2a379dedc94dd9e3bc02f19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwaretrojanupx

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 23 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_637c2aee2684494f5760cbf5280f5953_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxyInstaller.exe" 1450711444 "Darkest Dungeon®"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1450711444 /silent /game_name="Darkest Dungeon®"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5436
        • C:\Users\Admin\AppData\Local\Temp\is-AMUEDRX6XR.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-AMUEDRX6XR.tmp\GalaxySetup.tmp" /SL5="$9014E,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1450711444 /silent /game_name="Darkest Dungeon®"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5776
          • C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4160
            • C:\Windows\Temp\{3A0048D5-0466-4340-8583-C959B5A6C5FE}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{3A0048D5-0466-4340-8583-C959B5A6C5FE}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5944
              • C:\Windows\Temp\{3C1C32E7-E2CA-49D7-8FC7-2FA4302F6D2F}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{3C1C32E7-E2CA-49D7-8FC7-2FA4302F6D2F}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{CEB5DF92-DC91-4CE2-9A8F-8E19FCCBC708} {0706AE75-25F1-4485-8082-EEC369FF2960} 5944
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4900
          • C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2064
            • C:\Windows\Temp\{497E45CF-EF67-462E-8971-5DE26FE4287C}\.cr\vc_redist.x64.exe
              "C:\Windows\Temp\{497E45CF-EF67-462E-8971-5DE26FE4287C}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=596 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1676
              • C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A5D2AA7F-BF70-4EB9-8BCD-38E46BF75FC0} {68144539-9FE8-4C6B-B7FC-7A0A2C658281} 1676
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:3728
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1536
                7⤵
                • Program crash
                PID:5956
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: AddClipboardFormatListener
            PID:3512
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: AddClipboardFormatListener
            PID:4796
    • C:\Program Files\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1450711444
      2⤵
      • Executes dropped EXE
      PID:3004
      • C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe
        "C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4116 /prefetch:1
        3⤵
          PID:2772
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5668
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4580
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4456
    • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260821053123.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260821053123.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1676 -ip 1676
      1⤵
        PID:4532
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:5992
      • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
        "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1524
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        PID:4028
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
          PID:2156

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5b7939.rbs
              • Path C:\Config.Msi\e5b7939.rbs
              • Size 19KB
              • SHA256 09e906c4a04dcca54f71c1e7d0f326e1a111ce6e8c2edbdd813c113ac29e89eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5b7945.rbs
              • Path C:\Config.Msi\e5b7945.rbs
              • Size 19KB
              • SHA256 c88d8dc9cdfa66bdd8e35c990fb7b45beb2ffc35d9cbc7da7a54e415aae2873d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GalaxyClient.exe
              • Path C:\Program Files\GOG Galaxy\GalaxyClient.exe
              • Size 14.7MB
              • SHA256 c6f63ae1cad0136b693863fb2582ab8a0c4f30b77efc597d2743c687a3f4f3ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoData.dll
              • Path C:\Program Files\GOG Galaxy\PocoData.dll
              • Size 2.1MB
              • SHA256 970a5a0215dc51ee35f3e0ed3508feed50fa70b60fb9da27e9cdbc36ee500e99
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoDataSQLite.dll
              • Path C:\Program Files\GOG Galaxy\PocoDataSQLite.dll
              • Size 404KB
              • SHA256 5fd3840b1464fce1bf95223a097c7a2c217389b5ca2cf893aec91741f3c4a6c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoFoundation.dll
              • Path C:\Program Files\GOG Galaxy\PocoFoundation.dll
              • Size 2.1MB
              • SHA256 dff145ef5117ffb273316685b4669220b0b31204f92be09e82691a73a9b955a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoJSON.dll
              • Path C:\Program Files\GOG Galaxy\PocoJSON.dll
              • Size 388KB
              • SHA256 45b48529aafda73c60959609910b18e34d198e7c898cace6969d907694d622a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoNet.dll
              • Path C:\Program Files\GOG Galaxy\PocoNet.dll
              • Size 1.5MB
              • SHA256 24b103f8e5ae714a5b41f697624b13211397fa72608375d4e5ff8aa35715aa98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PocoUtil.dll
              • Path C:\Program Files\GOG Galaxy\PocoUtil.dll
              • Size 595KB
              • SHA256 234111be57fbcae98f2eeae7b5b8340343a5529159f38b10799270932c28eca6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6Core.dll
              • Path C:\Program Files\GOG Galaxy\Qt6Core.dll
              • Size 6.1MB
              • SHA256 ee1ac4133cb8618f0154b497f31ab5916e02144833632b3c9e83f41bb2631026
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6Gui.dll
              • Path C:\Program Files\GOG Galaxy\Qt6Gui.dll
              • Size 8.3MB
              • SHA256 257be29c3263eae197bd666a34814874403e94a9f9659fe786811353ab597150
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6Network.dll
              • Path C:\Program Files\GOG Galaxy\Qt6Network.dll
              • Size 1.6MB
              • SHA256 e5dda85d26ce26d97dba94fcd8407989bd1dbfb4eaf9e2487ef5966b9fb942ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6WebChannel.dll
              • Path C:\Program Files\GOG Galaxy\Qt6WebChannel.dll
              • Size 244KB
              • SHA256 9a7d3454c4a582130b6c6afd81e71902e23c56707838bcdd9342a6474a448867
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6WebEngineWidgets.dll
              • Path C:\Program Files\GOG Galaxy\Qt6WebEngineWidgets.dll
              • Size 180KB
              • SHA256 6b94116ee0576c07ddd0966e2febbb983c925d136f45765abf3f45201d100e34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt6Widgets.dll
              • Path C:\Program Files\GOG Galaxy\Qt6Widgets.dll
              • Size 6.3MB
              • SHA256 e1155224f31d54a7c79286b0f8014d1ffd70af187fb297a6ad29d3b8f75ee68b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-WV2IND6LF0.tmp
              • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-WV2IND6LF0.tmp
              • Size 18KB
              • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-D8V2BL14CW.tmp
              • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-D8V2BL14CW.tmp
              • Size 14B
              • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
              • MD5 SHA1 SHA512
              Submit Download

              sqlite.dll
              • Path C:\Program Files\GOG Galaxy\sqlite.dll
              • Size 1.1MB
              • SHA256 1875160d08be7a6bbe8989b1ba95738b2dffa3f444d5f2c93d8d797b9fc53da2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-3SWU1Y3U3K.tmp
              • Path C:\Program Files\GOG Galaxy\web\is-3SWU1Y3U3K.tmp
              • Size 27KB
              • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-VOMGUJAWUJ.tmp
              • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\is-VOMGUJAWUJ.tmp
              • Size 1KB
              • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              xdelta3.dll
              • Path C:\Program Files\GOG Galaxy\xdelta3.dll
              • Size 171KB
              • SHA256 01952a7e522f1e9caa2beccf9aaf930c312625a4565d6cfa35848ae6ae7fc6c5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              zlib1.dll
              • Path C:\Program Files\GOG Galaxy\zlib1.dll
              • Size 130KB
              • SHA256 1ac2cc7abd9449d8fd98a27f2c3d61f6e71cca8680183765c1e29cefa1cac44c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-5PQ66YHJRK.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-5PQ66YHJRK.tmp
              • Size 54KB
              • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-URX5JRYR4W.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-URX5JRYR4W.tmp
              • Size 40KB
              • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 76B
              • SHA256 2aefc577403ac70840f9b32ba520fa5a1878cbf48713d63e365bf33e4391bc61
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\ProgramData\GOG.com\Galaxy\config.json
              • Size 336B
              • SHA256 69601f552336ec1d8c57ccc2a74c7e1e997fd072d382e2b974d0f53d2c4c68e4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              InstallerWebinstaller.log
              • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
              • Size 717B
              • SHA256 6a8c2ac4c61d45ab7384ddcbe1045810c3bf723458cc227a7b969f4ec42366a8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-IQ046ZCUMV.tmp
              • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-IQ046ZCUMV.tmp
              • Size 147KB
              • SHA256 1725e73ff0c952cdb0771da3424e6f119f65ca5700acec06c3b8bcf78406f959
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              f_000008
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\Cache_Data\f_000008
              • Size 312KB
              • SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CURRENT
              • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\state.rsm
              • Size 992B
              • SHA256 e75eafb618a2653f37e394030857b6a8d894d9bba130c3fe670f603aee93f6e2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
              • Size 2KB
              • SHA256 4941824ada48c96373c8f3295f7428a3af30a82f95ea422d4ec721e370a3ecf3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              config.json
              • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
              • Size 2KB
              • SHA256 1133c21dc8a6f4bd34ae1796220bb0583313a3c7df3956c98f01ecd99f2718cf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              GalaxyInstaller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\GalaxyInstaller.exe
              • Size 120KB
              • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icon.ico
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\icon.ico
              • Size 111KB
              • SHA256 713aff4b88b1e35c899b216e8694d9cc8eae6d66d3f6d9227b738fffdb1ddeff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              remoteconfig.json
              • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_UbDDm\remoteconfig.json
              • Size 529B
              • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260821053123.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260821053123.log
              • Size 8KB
              • SHA256 935e8dcc6a8267f654656a52c7ecaa04f672725618b071ed77e544e5b1a067ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260821053123_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260821053123_000_vcRuntimeMinimum_x64.log
              • Size 2KB
              • SHA256 2d77a02d8d189145dbe8b08d00ee37cb17cdbf8fb8a5123ca8939c4dc2c878ca
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _isdecmp.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\_isetup\_isdecmp.dll
              • Size 27KB
              • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x64.exe
              • Size 17.9MB
              • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x86.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-57GJ2ZLYQU.tmp\vc_redist.x86.exe
              • Size 6.7MB
              • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GalaxySetup.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-AMUEDRX6XR.tmp\GalaxySetup.tmp
              • Size 7.0MB
              • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x86.exe
              • Path C:\Windows\Temp\{3A0048D5-0466-4340-8583-C959B5A6C5FE}\.cr\vc_redist.x86.exe
              • Size 668KB
              • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{3C1C32E7-E2CA-49D7-8FC7-2FA4302F6D2F}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{3C1C32E7-E2CA-49D7-8FC7-2FA4302F6D2F}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x64.exe
              • Path C:\Windows\Temp\{497E45CF-EF67-462E-8971-5DE26FE4287C}\.cr\vc_redist.x64.exe
              • Size 669KB
              • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\cab5046A8AB272BF37297BB7928664C9503
              • Size 1.0MB
              • SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\vcRuntimeAdditional_x64
              • Size 208KB
              • SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{6CE76D02-1615-4A56-9292-69D090CCDC99}\vcRuntimeMinimum_x64
              • Size 208KB
              • SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              license.rtf
              • Path C:\Windows\Temp\{FA9C8AF4-D3DC-4F70-86A6-19144C543D99}\.ba\license.rtf
              • Size 9KB
              • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              thm.wxl
              • Path C:\Windows\Temp\{FA9C8AF4-D3DC-4F70-86A6-19144C543D99}\.ba\thm.wxl
              • Size 2KB
              • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              thm.xml
              • Path C:\Windows\Temp\{FA9C8AF4-D3DC-4F70-86A6-19144C543D99}\.ba\thm.xml
              • Size 8KB
              • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2280-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-38-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-14-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp
              Download

              memory/2280-15-0x00000000003A0000-0x00000000003C0000-memory.dmp
              Download

              memory/2280-17-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-18-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-29-0x000000001E240000-0x000000001E402000-memory.dmp
              Download

              memory/2280-43-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-44-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-45-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-46-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-30-0x000000001E940000-0x000000001EE68000-memory.dmp
              Download

              memory/2280-41-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-40-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-39-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-2835-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-34-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-33-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-32-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2280-31-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
              Download

              memory/2772-2863-0x00007FFC36AA0000-0x00007FFC36AA1000-memory.dmp
              Download

              memory/2772-2862-0x00007FFC36A90000-0x00007FFC36A91000-memory.dmp
              Download

              memory/2772-2864-0x00007FFC11730000-0x00007FFC11CB4000-memory.dmp
              Download

              memory/3004-2836-0x00007FFC13410000-0x00007FFC13A57000-memory.dmp
              Download

              memory/3512-2325-0x00007FFBF7A30000-0x00007FFBF8A30000-memory.dmp
              Download

              memory/3512-2328-0x00007FFC0DFC0000-0x00007FFC0E607000-memory.dmp
              Download

              memory/3512-2327-0x00007FFC07F90000-0x00007FFC08514000-memory.dmp
              Download

              memory/4796-2816-0x00007FFC0E3D0000-0x00007FFC0E954000-memory.dmp
              Download

              memory/4796-2815-0x00007FFC0C460000-0x00007FFC0CAA7000-memory.dmp
              Download

              memory/4836-42-0x0000000000400000-0x000000000051E000-memory.dmp
              Download

              memory/4836-0-0x0000000000400000-0x000000000051E000-memory.dmp
              Download

              memory/4836-2840-0x0000000000400000-0x000000000051E000-memory.dmp
              Download

              memory/5436-2829-0x0000000000CE0000-0x0000000000EAB000-memory.dmp
              Download

              memory/5436-60-0x0000000000CE0000-0x0000000000EAB000-memory.dmp
              Download

              memory/5436-484-0x0000000000CE0000-0x0000000000EAB000-memory.dmp
              Download

              memory/5776-2819-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-2828-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-2323-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-2109-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-485-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-2033-0x0000000000290000-0x000000000099D000-memory.dmp
              Download

              memory/5776-2043-0x0000000000290000-0x000000000099D000-memory.dmp
              Download