Overview

overview

9

Static

static

3

2026-08-23...os.exe

windows10-2004-x64

9

2026-08-23...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/08/2026, 23:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.8MB
  • Sample260825-246n5azerd
  • SHA256 3d89527990c24c3463d08101749e13d60f3947e5622954223f8f9b9c4dd67289
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxyInstaller.exe" 1971477531 "GWENT: The Witcher Card Game"
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Users\Admin\AppData\Local\Temp\is-42RXTVHIIB.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-42RXTVHIIB.tmp\GalaxySetup.tmp" /SL5="$10007A,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3544
            • C:\Windows\Temp\{F0F54FFD-3289-497C-8E15-05F062C26D53}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{F0F54FFD-3289-497C-8E15-05F062C26D53}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x86.exe" -burn.filehandle.attached=720 -burn.filehandle.self=724 /install /quiet /norestart
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4496
              • C:\Windows\Temp\{6EA345BF-7E82-41FA-9032-9A52D1CDA261}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{6EA345BF-7E82-41FA-9032-9A52D1CDA261}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{62F148D6-7864-4BCD-ADB3-04BC596BB7ED} {A903C50E-2DAC-4C8D-BEAC-A11F71B5EB45} 4496
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2116
          • C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4556
            • C:\Windows\Temp\{9C6B74EE-0227-469F-87C3-9086E36CDE3D}\.cr\vc_redist.x64.exe
              "C:\Windows\Temp\{9C6B74EE-0227-469F-87C3-9086E36CDE3D}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x64.exe" -burn.filehandle.attached=720 -burn.filehandle.self=724 /install /quiet /norestart
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4380
              • C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4E281024-83BC-467E-AE36-77AAADAFDAD0} {60462974-4561-41E3-8045-A3CAF0283D2C} 4380
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:4060
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1468
                7⤵
                • Program crash
                PID:2096
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3776
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious behavior: AddClipboardFormatListener
            PID:3816
    • C:\Program Files\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1971477531 /payload=eyJsb2dpbl9wYXJhbWV0ZXJzIjoib3JpZ2luPWh0dHBzJTNBJTJGJTJGd3d3LnBsYXlnd2VudC5jb20lMkZlbiUyRnBsYXktZ29nJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjE1MS4wLjAuMCtTYWZhcmklMkY1MzcuMzYrRWRnJTJGMTUxLjAuMC4wJnVuaXF1ZV9pZD0xNzg3NDMzMjYxLTglMkZFd1NGb3BDRUFOSlNKNWtuS2wydyUzRCUzRCIsImNhbXBhaWduIjp7Im9yaWdpbiI6Imh0dHBzOlwvXC93d3cucGxheWd3ZW50LmNvbVwvZW5cL3BsYXktZ29nIiwib3JpZ2luX3VzZXJfYWdlbnQiOiJNb3ppbGxhXC81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXRcLzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZVwvMTUxLjAuMC4wIFNhZmFyaVwvNTM3LjM2IEVkZ1wvMTUxLjAuMC4wIiwidW5pcXVlX2lkIjoiMTc4NzQzMzI2MS04XC9Fd1NGb3BDRUFOSlNKNWtuS2wydz09In19
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe
        "C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4016 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3636
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2440
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4312
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:176
    • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001040.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001040.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C31276AC-68C8-4641-8F69-CB36E7210624} {8A49A334-7F2E-4D14-845A-51A5B89E64C0} 3812
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1212 -burn.embedded BurnPipe.{72FFF171-E965-4863-8B2C-D6F35A8788AF} {E0E952A2-6D03-46F2-BBA6-5EEE2F5B6567} 2736
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4664
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1212 -burn.embedded BurnPipe.{72FFF171-E965-4863-8B2C-D6F35A8788AF} {E0E952A2-6D03-46F2-BBA6-5EEE2F5B6567} 2736
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1224
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AA66E71C-AB26-48FF-819C-FADA93BAC99E} {8CA26E5D-3EC6-4751-AFBC-A6D63B9008E4} 1224
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4380 -ip 4380
      1⤵
        PID:312

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59ac0a.rbs
            • Path C:\Config.Msi\e59ac0a.rbs
            • Size 19KB
            • SHA256 42a5f7f7efa7a20245ff0d14d106f10aa35ecb0a4b4e64b73fc26ffff37a57d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59ac16.rbs
            • Path C:\Config.Msi\e59ac16.rbs
            • Size 19KB
            • SHA256 c52ef41fa937756894a37816e5ffe000b289bfad4230592e27b03c6313e7c612
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59ac1d.rbs
            • Path C:\Config.Msi\e59ac1d.rbs
            • Size 21KB
            • SHA256 1f7b6a3d39543dfbbe48e56b494df080f099b80db0c5cf82ca9cb66fe1922ec7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59ac2c.rbs
            • Path C:\Config.Msi\e59ac2c.rbs
            • Size 21KB
            • SHA256 b0bcfa59bed07dc69dc0b67d0598a6df0bb17467be345c0124d0273401facfbd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GalaxyClient.exe
            • Path C:\Program Files\GOG Galaxy\GalaxyClient.exe
            • Size 14.7MB
            • SHA256 c6f63ae1cad0136b693863fb2582ab8a0c4f30b77efc597d2743c687a3f4f3ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoData.dll
            • Path C:\Program Files\GOG Galaxy\PocoData.dll
            • Size 2.1MB
            • SHA256 970a5a0215dc51ee35f3e0ed3508feed50fa70b60fb9da27e9cdbc36ee500e99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoDataSQLite.dll
            • Path C:\Program Files\GOG Galaxy\PocoDataSQLite.dll
            • Size 404KB
            • SHA256 5fd3840b1464fce1bf95223a097c7a2c217389b5ca2cf893aec91741f3c4a6c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoFoundation.dll
            • Path C:\Program Files\GOG Galaxy\PocoFoundation.dll
            • Size 2.1MB
            • SHA256 dff145ef5117ffb273316685b4669220b0b31204f92be09e82691a73a9b955a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoJSON.dll
            • Path C:\Program Files\GOG Galaxy\PocoJSON.dll
            • Size 388KB
            • SHA256 45b48529aafda73c60959609910b18e34d198e7c898cace6969d907694d622a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoNet.dll
            • Path C:\Program Files\GOG Galaxy\PocoNet.dll
            • Size 1.5MB
            • SHA256 24b103f8e5ae714a5b41f697624b13211397fa72608375d4e5ff8aa35715aa98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoUtil.dll
            • Path C:\Program Files\GOG Galaxy\PocoUtil.dll
            • Size 595KB
            • SHA256 234111be57fbcae98f2eeae7b5b8340343a5529159f38b10799270932c28eca6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Gui.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Gui.dll
            • Size 8.3MB
            • SHA256 257be29c3263eae197bd666a34814874403e94a9f9659fe786811353ab597150
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Network.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Network.dll
            • Size 1.6MB
            • SHA256 e5dda85d26ce26d97dba94fcd8407989bd1dbfb4eaf9e2487ef5966b9fb942ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6WebChannel.dll
            • Path C:\Program Files\GOG Galaxy\Qt6WebChannel.dll
            • Size 244KB
            • SHA256 9a7d3454c4a582130b6c6afd81e71902e23c56707838bcdd9342a6474a448867
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6WebEngineWidgets.dll
            • Path C:\Program Files\GOG Galaxy\Qt6WebEngineWidgets.dll
            • Size 180KB
            • SHA256 6b94116ee0576c07ddd0966e2febbb983c925d136f45765abf3f45201d100e34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Widgets.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 e1155224f31d54a7c79286b0f8014d1ffd70af187fb297a6ad29d3b8f75ee68b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-JB8QB4CHVE.tmp
            • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-JB8QB4CHVE.tmp
            • Size 18KB
            • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-62HCDTR592.tmp
            • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-62HCDTR592.tmp
            • Size 14B
            • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
            • MD5 SHA1 SHA512
            Submit Download

            sqlite.dll
            • Path C:\Program Files\GOG Galaxy\sqlite.dll
            • Size 1.1MB
            • SHA256 1875160d08be7a6bbe8989b1ba95738b2dffa3f444d5f2c93d8d797b9fc53da2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-KK9B42VU3F.tmp
            • Path C:\Program Files\GOG Galaxy\web\is-KK9B42VU3F.tmp
            • Size 27KB
            • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-LYFK7KXKYJ.tmp
            • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\is-LYFK7KXKYJ.tmp
            • Size 1KB
            • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xdelta3.dll
            • Path C:\Program Files\GOG Galaxy\xdelta3.dll
            • Size 171KB
            • SHA256 01952a7e522f1e9caa2beccf9aaf930c312625a4565d6cfa35848ae6ae7fc6c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Program Files\GOG Galaxy\zlib1.dll
            • Size 130KB
            • SHA256 1ac2cc7abd9449d8fd98a27f2c3d61f6e71cca8680183765c1e29cefa1cac44c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-8TIIGEUB4A.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-8TIIGEUB4A.tmp
            • Size 40KB
            • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-QCGGPOVB9D.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-QCGGPOVB9D.tmp
            • Size 54KB
            • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.json
            • Path C:\ProgramData\GOG.com\Galaxy\config.json
            • Size 76B
            • SHA256 2aefc577403ac70840f9b32ba520fa5a1878cbf48713d63e365bf33e4391bc61
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\ProgramData\GOG.com\Galaxy\config.json
            • Size 141B
            • SHA256 9b0b4fe1a3a0d98c785f6887411978f1d572885d1d491c9a2f41d71793325630
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            is-8C6ENU7HZP.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-8C6ENU7HZP.tmp
            • Size 147KB
            • SHA256 1725e73ff0c952cdb0771da3424e6f119f65ca5700acec06c3b8bcf78406f959
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000a
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\Cache_Data\f_00000a
            • Size 312KB
            • SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
            • Size 2KB
            • SHA256 f0f6809bb24559b0bf7e9a2ff3eca37ae99aafcc4313142dfe7ea73cec7f94a7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
            • Size 2KB
            • SHA256 1133c21dc8a6f4bd34ae1796220bb0583313a3c7df3956c98f01ecd99f2718cf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
            • Size 3KB
            • SHA256 495e1eab13e7d6a0d568cfebe9e56905136ca07ba8707ae448cc4b374d4b77ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GalaxyInstaller.exe
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\GalaxyInstaller.exe
            • Size 607KB
            • SHA256 0fc3b42a96b6ac0fa20556bac1d6a58071436952cddd8655545dc24ff207a09a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon.ico
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\icon.ico
            • Size 520KB
            • SHA256 d09ccaf753e884a02976544208a33b72a17e74eba9a0254b355554752f4a267f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            payload.campaign
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\payload.campaign
            • Size 557B
            • SHA256 debaea8d2bca496705873e87cfee75c0cb80746772ebf33e90a53522dc0174f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            remoteconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DILEI\remoteconfig.json
            • Size 529B
            • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260826001040.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001040.log
            • Size 8KB
            • SHA256 c7a9e9e2c5288666a1956c6dd880b6bdd22ee8340dc4d19f3c3355190f9c3698
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260826001040_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001040_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 408b861923b87cecb7014e13f22284a51b6da4a6f8956e2bdca1ab445b65e1d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _isdecmp.dll
            • Path C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\_isetup\_isdecmp.dll
            • Size 27KB
            • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x64.exe
            • Size 17.9MB
            • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x86.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-254RTGEOIY.tmp\vc_redist.x86.exe
            • Size 6.7MB
            • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GalaxySetup.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-42RXTVHIIB.tmp\GalaxySetup.tmp
            • Size 7.0MB
            • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{6EA345BF-7E82-41FA-9032-9A52D1CDA261}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{6EA345BF-7E82-41FA-9032-9A52D1CDA261}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Windows\Temp\{9C6B74EE-0227-469F-87C3-9086E36CDE3D}\.cr\vc_redist.x64.exe
            • Size 669KB
            • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{CEB3A836-B4EE-44F5-AC37-31070A83DAE2}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{CEB3A836-B4EE-44F5-AC37-31070A83DAE2}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{CEB3A836-B4EE-44F5-AC37-31070A83DAE2}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\cab5046A8AB272BF37297BB7928664C9503
            • Size 1.0MB
            • SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{E2254BC6-B82D-4650-B220-3674350E656C}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x86.exe
            • Path C:\Windows\Temp\{F0F54FFD-3289-497C-8E15-05F062C26D53}\.cr\vc_redist.x86.exe
            • Size 668KB
            • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1184-390-0x000000001B060000-0x000000001B070000-memory.dmp
            Download

            memory/1184-28-0x000000001D970000-0x000000001DB32000-memory.dmp
            Download

            memory/1184-29-0x000000001E070000-0x000000001E598000-memory.dmp
            Download

            memory/1184-16-0x000000001B060000-0x000000001B070000-memory.dmp
            Download

            memory/1184-15-0x0000000000460000-0x00000000004FC000-memory.dmp
            Download

            memory/1184-31-0x000000001B060000-0x000000001B070000-memory.dmp
            Download

            memory/1184-37-0x000000001B060000-0x000000001B070000-memory.dmp
            Download

            memory/1224-2412-0x0000000000A40000-0x0000000000AB7000-memory.dmp
            Download

            memory/1756-2673-0x0000000000650000-0x000000000081B000-memory.dmp
            Download

            memory/1756-689-0x0000000000650000-0x000000000081B000-memory.dmp
            Download

            memory/1756-53-0x0000000000650000-0x000000000081B000-memory.dmp
            Download

            memory/3636-2884-0x00000276279C0000-0x0000027627A15000-memory.dmp
            Download

            memory/3636-2756-0x00007FFCD4620000-0x00007FFCD4BA4000-memory.dmp
            Download

            memory/3636-2755-0x00007FFCF2030000-0x00007FFCF2031000-memory.dmp
            Download

            memory/3636-2754-0x00007FFCF3E70000-0x00007FFCF3E71000-memory.dmp
            Download

            memory/3776-2417-0x00007FFCC9680000-0x00007FFCC9BED000-memory.dmp
            Download

            memory/3816-2424-0x00007FFCC9820000-0x00007FFCC9DA4000-memory.dmp
            Download

            memory/3816-2423-0x00007FFCCB4F0000-0x00007FFCCBB37000-memory.dmp
            Download

            memory/3816-2426-0x00007FFCC9820000-0x00007FFCC9DA4000-memory.dmp
            Download

            memory/3816-2425-0x00007FFCB79F0000-0x00007FFCB89F0000-memory.dmp
            Download

            memory/3940-2428-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/3940-2289-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/3940-2038-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/3940-2672-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/3940-2091-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/3940-694-0x0000000000F40000-0x000000000164D000-memory.dmp
            Download

            memory/4396-2681-0x00007FFCD4620000-0x00007FFCD4BA4000-memory.dmp
            Download

            memory/4396-2680-0x00007FFCD63A0000-0x00007FFCD69E7000-memory.dmp
            Download

            memory/4612-2410-0x0000000000A40000-0x0000000000AB7000-memory.dmp
            Download

            memory/4664-2413-0x0000000000A40000-0x0000000000AB7000-memory.dmp
            Download

            memory/4916-0-0x0000000000290000-0x0000000000469000-memory.dmp
            Download