Overview

overview

10

Static

static

10

2026-08-23...os.exe

windows10-2004-x64

9

2026-08-23...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_af87b4b76a3ff92a71adf3423b6bbea7_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.1MB
  • Sample260824-btlyvssamd
  • SHA256 733a2de84e5db83c897407b0940a77c474547ddab6e6f1841a566ec0a5dd0414
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 23 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 49 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_af87b4b76a3ff92a71adf3423b6bbea7_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_af87b4b76a3ff92a71adf3423b6bbea7_coinminer_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxyInstaller.exe" 1967904485 "Yet Another Zombie Survivors"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1967904485 /silent /game_name="Yet Another Zombie Survivors"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Users\Admin\AppData\Local\Temp\is-AQO2Q8FRSU.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-AQO2Q8FRSU.tmp\GalaxySetup.tmp" /SL5="$702D0,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1967904485 /silent /game_name="Yet Another Zombie Survivors"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3056
          • C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1640
            • C:\Windows\Temp\{B105C079-54DD-422F-8569-AF37414A5FA9}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{B105C079-54DD-422F-8569-AF37414A5FA9}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6140
              • C:\Windows\Temp\{81C43336-16D6-42F5-8D38-73D0648CA928}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{81C43336-16D6-42F5-8D38-73D0648CA928}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{FEF31672-129E-4362-AC91-3598D91EA7EE} {FB7F54A4-987D-4EF7-9E1B-C7BF6790E8F3} 6140
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3216
          • C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\Windows\Temp\{43955A6C-9A46-422A-BBCC-A582BB1812C3}\.cr\vc_redist.x64.exe
              "C:\Windows\Temp\{43955A6C-9A46-422A-BBCC-A582BB1812C3}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=704 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:788
              • C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7D7F3CB4-848A-4FB8-BCF5-2F3D0721D8FC} {EAB69ED4-9050-473F-B58B-F63FB05B925B} 788
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:1096
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: AddClipboardFormatListener
            PID:2852
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious behavior: AddClipboardFormatListener
            PID:5704
    • C:\Program Files\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1967904485
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: AddClipboardFormatListener
      PID:2528
      • C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe
        "C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4156 /prefetch:1
        3⤵
          PID:3176
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4284
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5108
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4492
    • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823212755.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823212755.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4504
    • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
      "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3028
    • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
      "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1972
    • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
      "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
      1⤵
      • Executes dropped EXE
      PID:2436
    • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
      "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
      1⤵
      • Executes dropped EXE
      PID:1652

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5abc80.rbs
          • Path C:\Config.Msi\e5abc80.rbs
          • Size 19KB
          • SHA256 e3fafa911380dac4ac0d6f87eef44ba853ff01e0d270dc60aa35f2c277b42d58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5abc8c.rbs
          • Path C:\Config.Msi\e5abc8c.rbs
          • Size 19KB
          • SHA256 f283bc081d812604df1deeae2228690a12364863f34b6ad9f59d86ea74b37197
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GalaxyClient.exe
          • Path C:\Program Files\GOG Galaxy\GalaxyClient.exe
          • Size 14.7MB
          • SHA256 c6f63ae1cad0136b693863fb2582ab8a0c4f30b77efc597d2743c687a3f4f3ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoData.dll
          • Path C:\Program Files\GOG Galaxy\PocoData.dll
          • Size 2.1MB
          • SHA256 970a5a0215dc51ee35f3e0ed3508feed50fa70b60fb9da27e9cdbc36ee500e99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoDataSQLite.dll
          • Path C:\Program Files\GOG Galaxy\PocoDataSQLite.dll
          • Size 404KB
          • SHA256 5fd3840b1464fce1bf95223a097c7a2c217389b5ca2cf893aec91741f3c4a6c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoFoundation.dll
          • Path C:\Program Files\GOG Galaxy\PocoFoundation.dll
          • Size 2.1MB
          • SHA256 dff145ef5117ffb273316685b4669220b0b31204f92be09e82691a73a9b955a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoJSON.dll
          • Path C:\Program Files\GOG Galaxy\PocoJSON.dll
          • Size 388KB
          • SHA256 45b48529aafda73c60959609910b18e34d198e7c898cace6969d907694d622a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoNet.dll
          • Path C:\Program Files\GOG Galaxy\PocoNet.dll
          • Size 1.5MB
          • SHA256 24b103f8e5ae714a5b41f697624b13211397fa72608375d4e5ff8aa35715aa98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PocoUtil.dll
          • Path C:\Program Files\GOG Galaxy\PocoUtil.dll
          • Size 595KB
          • SHA256 234111be57fbcae98f2eeae7b5b8340343a5529159f38b10799270932c28eca6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Core.dll
          • Path C:\Program Files\GOG Galaxy\Qt6Core.dll
          • Size 6.1MB
          • SHA256 ee1ac4133cb8618f0154b497f31ab5916e02144833632b3c9e83f41bb2631026
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Gui.dll
          • Path C:\Program Files\GOG Galaxy\Qt6Gui.dll
          • Size 8.3MB
          • SHA256 257be29c3263eae197bd666a34814874403e94a9f9659fe786811353ab597150
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Network.dll
          • Path C:\Program Files\GOG Galaxy\Qt6Network.dll
          • Size 1.6MB
          • SHA256 e5dda85d26ce26d97dba94fcd8407989bd1dbfb4eaf9e2487ef5966b9fb942ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6WebChannel.dll
          • Path C:\Program Files\GOG Galaxy\Qt6WebChannel.dll
          • Size 244KB
          • SHA256 9a7d3454c4a582130b6c6afd81e71902e23c56707838bcdd9342a6474a448867
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6WebEngineWidgets.dll
          • Path C:\Program Files\GOG Galaxy\Qt6WebEngineWidgets.dll
          • Size 180KB
          • SHA256 6b94116ee0576c07ddd0966e2febbb983c925d136f45765abf3f45201d100e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Widgets.dll
          • Path C:\Program Files\GOG Galaxy\Qt6Widgets.dll
          • Size 6.3MB
          • SHA256 e1155224f31d54a7c79286b0f8014d1ffd70af187fb297a6ad29d3b8f75ee68b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-HZYR8FVSZO.tmp
          • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-HZYR8FVSZO.tmp
          • Size 18KB
          • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-RW4VLIBS5K.tmp
          • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-RW4VLIBS5K.tmp
          • Size 14B
          • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
          • MD5 SHA1 SHA512
          Submit Download

          sqlite.dll
          • Path C:\Program Files\GOG Galaxy\sqlite.dll
          • Size 1.1MB
          • SHA256 1875160d08be7a6bbe8989b1ba95738b2dffa3f444d5f2c93d8d797b9fc53da2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-I05LA2AP8F.tmp
          • Path C:\Program Files\GOG Galaxy\web\is-I05LA2AP8F.tmp
          • Size 27KB
          • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-0GHRWHS4UJ.tmp
          • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\is-0GHRWHS4UJ.tmp
          • Size 1KB
          • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          xdelta3.dll
          • Path C:\Program Files\GOG Galaxy\xdelta3.dll
          • Size 171KB
          • SHA256 01952a7e522f1e9caa2beccf9aaf930c312625a4565d6cfa35848ae6ae7fc6c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Program Files\GOG Galaxy\zlib1.dll
          • Size 130KB
          • SHA256 1ac2cc7abd9449d8fd98a27f2c3d61f6e71cca8680183765c1e29cefa1cac44c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-9SQQZS6XYH.tmp
          • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-9SQQZS6XYH.tmp
          • Size 40KB
          • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-U7V4GIM4HP.tmp
          • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-U7V4GIM4HP.tmp
          • Size 54KB
          • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          config.json
          • Path C:\ProgramData\GOG.com\Galaxy\config.json
          • Size 76B
          • SHA256 2aefc577403ac70840f9b32ba520fa5a1878cbf48713d63e365bf33e4391bc61
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\ProgramData\GOG.com\Galaxy\config.json
          • Size 336B
          • SHA256 69601f552336ec1d8c57ccc2a74c7e1e997fd072d382e2b974d0f53d2c4c68e4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          InstallerWebinstaller.log
          • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
          • Size 728B
          • SHA256 c95d02801655f953c61e002ce7c19186ecc03b66fa379dc224528862f7f70ef6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-E33LPMLFHH.tmp
          • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-E33LPMLFHH.tmp
          • Size 147KB
          • SHA256 1725e73ff0c952cdb0771da3424e6f119f65ca5700acec06c3b8bcf78406f959
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000009
          • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\Cache_Data\f_000009
          • Size 761KB
          • SHA256 01be064309a86e96786ed620d589237af77b00ae1a0892b042669f8c8bf223ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
          • Size 2KB
          • SHA256 90c2d252ab8d27fbd63eb204609e9ef530058f863f48912b3b35a2d007bed652
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
          • Size 2KB
          • SHA256 1133c21dc8a6f4bd34ae1796220bb0583313a3c7df3956c98f01ecd99f2718cf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GalaxyInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\GalaxyInstaller.exe
          • Size 120KB
          • SHA256 9e246ee6babdc3861578c36af8c652d4d4be1f3e83583472bcfdb3ea238eeec2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icon.ico
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\icon.ico
          • Size 105KB
          • SHA256 745ad0b95d941db4396bd0022a85dff62944168ba0e096fab1c2b7cdfffb287a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          remoteconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_LzEaV\remoteconfig.json
          • Size 529B
          • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260823212755.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823212755.log
          • Size 12KB
          • SHA256 41f86891cde3b9917974089c4c74e1622b24d7b75f1ff6bdc828d4de218b9b1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260823212755_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823212755_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 aeacf82c33722fb2e35ac78b68fc66d1a0bd02007cca4e2a77226e488f3e6b1a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GalaxySetup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-AQO2Q8FRSU.tmp\GalaxySetup.tmp
          • Size 7.0MB
          • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _isdecmp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\_isetup\_isdecmp.dll
          • Size 27KB
          • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x64.exe
          • Size 17.9MB
          • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-SWLEEWWVUH.tmp\vc_redist.x86.exe
          • Size 6.7MB
          • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Windows\SYSTEM32\MSVCP140.dll
          • Size 627KB
          • SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_ATOMIC_WAIT.dll
          • Path C:\Windows\SYSTEM32\MSVCP140_ATOMIC_WAIT.dll
          • Size 56KB
          • SHA256 d759dd381bdbd6142372de4cb57acc382e1b80c106b7414a408816564ee1eb6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{43955A6C-9A46-422A-BBCC-A582BB1812C3}\.cr\vc_redist.x64.exe
          • Size 669KB
          • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{81C43336-16D6-42F5-8D38-73D0648CA928}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{81C43336-16D6-42F5-8D38-73D0648CA928}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{8D458731-9D18-46E1-BDCC-31D01D37D7CC}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{8D458731-9D18-46E1-BDCC-31D01D37D7CC}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{8D458731-9D18-46E1-BDCC-31D01D37D7CC}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Windows\Temp\{B105C079-54DD-422F-8569-AF37414A5FA9}\.cr\vc_redist.x86.exe
          • Size 668KB
          • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\cab5046A8AB272BF37297BB7928664C9503
          • Size 1.0MB
          • SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{FB5EA423-B2C5-40F1-B654-10BE2E991635}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2292-31-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-44-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-14-0x00007FF92979F000-0x00007FF9297A0000-memory.dmp
          Download

          memory/2292-15-0x0000000000660000-0x0000000000680000-memory.dmp
          Download

          memory/2292-43-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-18-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-2833-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-46-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-48-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-47-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-45-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-29-0x000000001E4A0000-0x000000001E662000-memory.dmp
          Download

          memory/2292-30-0x000000001EBA0000-0x000000001F0C8000-memory.dmp
          Download

          memory/2292-16-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-41-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-40-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-39-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-38-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-37-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-36-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-35-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2292-17-0x00007FF929610000-0x00007FF929FB4000-memory.dmp
          Download

          memory/2528-2834-0x00007FF926FE0000-0x00007FF927564000-memory.dmp
          Download

          memory/2528-2836-0x00007FF928D70000-0x00007FF9293B7000-memory.dmp
          Download

          memory/2852-2317-0x00007FF923330000-0x00007FF923977000-memory.dmp
          Download

          memory/2852-2327-0x00007FF91E2C0000-0x00007FF91E844000-memory.dmp
          Download

          memory/3056-2826-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3056-2183-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3056-2812-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3056-2043-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3056-2045-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3056-945-0x0000000000180000-0x000000000088D000-memory.dmp
          Download

          memory/3064-42-0x0000000000400000-0x000000000051B000-memory.dmp
          Download

          memory/3064-2839-0x0000000000400000-0x000000000051B000-memory.dmp
          Download

          memory/3064-0-0x0000000000400000-0x000000000051B000-memory.dmp
          Download

          memory/3176-2919-0x000001A9DF6B0000-0x000001A9DF786000-memory.dmp
          Download

          memory/3176-2863-0x00007FF926FE0000-0x00007FF927564000-memory.dmp
          Download

          memory/3176-2862-0x00007FF94B140000-0x00007FF94B141000-memory.dmp
          Download

          memory/3176-2861-0x00007FF94B480000-0x00007FF94B481000-memory.dmp
          Download

          memory/3564-2330-0x00000000008E0000-0x0000000000959000-memory.dmp
          Download

          memory/4504-2329-0x00000000008E0000-0x0000000000959000-memory.dmp
          Download

          memory/4872-644-0x00000000008C0000-0x0000000000A8B000-memory.dmp
          Download

          memory/4872-62-0x00000000008C0000-0x0000000000A8B000-memory.dmp
          Download

          memory/4872-2827-0x00000000008C0000-0x0000000000A8B000-memory.dmp
          Download

          memory/5704-2816-0x00007FF91EA10000-0x00007FF91EF94000-memory.dmp
          Download

          memory/5704-2815-0x00007FF923710000-0x00007FF923D57000-memory.dmp
          Download

          memory/5704-2817-0x00007FF908F90000-0x00007FF909F90000-memory.dmp
          Download