Overview

overview

9

Static

static

3

2026-08-23...os.exe

windows10-2004-x64

9

2026-08-23...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 23:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
  • Size 1.8MB
  • Sample260825-246n5azerd
  • SHA256 3d89527990c24c3463d08101749e13d60f3947e5622954223f8f9b9c4dd67289
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryinstallerpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9a816acbb141cdd300deb566871c7a82_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxyInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxyInstaller.exe" 1971477531 "GWENT: The Witcher Card Game"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxySetup.exe
        "C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Users\Admin\AppData\Local\Temp\is-B3WIQ4DFJC.tmp\GalaxySetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-B3WIQ4DFJC.tmp\GalaxySetup.tmp" /SL5="$C017C,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1971477531 /silent /game_name="GWENT: The Witcher Card Game"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x86.exe
            "C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x86.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\Temp\{0C3B24EF-15D0-40E0-AE9E-06DB219E3473}\.cr\vc_redist.x86.exe
              "C:\Windows\Temp\{0C3B24EF-15D0-40E0-AE9E-06DB219E3473}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5804
              • C:\Windows\Temp\{E773BBE3-17F4-46EA-AC18-003BF5CFCAE0}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{E773BBE3-17F4-46EA-AC18-003BF5CFCAE0}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{377F65BF-B4D2-426F-8910-1852D970EA05} {AB66F4C2-360B-4F16-9A13-2ED37E22075A} 5804
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4652
          • C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x64.exe" /install /quiet /norestart
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1252
            • C:\Windows\Temp\{B12E9EE9-7AA8-427A-BE8E-67FDD2C50977}\.cr\vc_redist.x64.exe
              "C:\Windows\Temp\{B12E9EE9-7AA8-427A-BE8E-67FDD2C50977}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=636 /install /quiet /norestart
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4528
              • C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D3E7B17D-4D7C-4765-9C66-901A851999C4} {A594F20D-B8E4-4ED0-A52F-193F96222721} 4528
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:1216
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1064
                7⤵
                • Program crash
                PID:5436
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: AddClipboardFormatListener
            PID:4740
          • C:\Program Files\GOG Galaxy\GalaxyClient.exe
            "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious behavior: AddClipboardFormatListener
            PID:4892
    • C:\Program Files\GOG Galaxy\GalaxyClient.exe
      "C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=1971477531 /payload=eyJsb2dpbl9wYXJhbWV0ZXJzIjoib3JpZ2luPWh0dHBzJTNBJTJGJTJGd3d3LnBsYXlnd2VudC5jb20lMkZlbiUyRnBsYXktZ29nJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjE1MS4wLjAuMCtTYWZhcmklMkY1MzcuMzYrRWRnJTJGMTUxLjAuMC4wJnVuaXF1ZV9pZD0xNzg3NDMzMjYxLTglMkZFd1NGb3BDRUFOSlNKNWtuS2wydyUzRCUzRCIsImNhbXBhaWduIjp7Im9yaWdpbiI6Imh0dHBzOlwvXC93d3cucGxheWd3ZW50LmNvbVwvZW5cL3BsYXktZ29nIiwib3JpZ2luX3VzZXJfYWdlbnQiOiJNb3ppbGxhXC81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXRcLzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZVwvMTUxLjAuMC4wIFNhZmFyaVwvNTM3LjM2IEVkZ1wvMTUxLjAuMC4wIiwidW5pcXVlX2lkIjoiMTc4NzQzMzI2MS04XC9Fd1NGb3BDRUFOSlNKNWtuS2wydz09In19
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe
        "C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4148 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4488
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5304
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1868
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4292
  • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001036.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001036.log" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0320841F-9F76-4750-A10F-AB5FB7D65055} {7CA7BC40-E35F-442F-8DD4-4C60F61E9498} 3660
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:1044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 968
          4⤵
          • Program crash
          PID:2040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4528 -ip 4528
    1⤵
      PID:3300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3660 -ip 3660
      1⤵
        PID:1948
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1876
      • C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
        "C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2656
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        PID:5340
      • C:\Program Files\GOG Galaxy\GalaxyClientService.exe
        "\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"
        1⤵
        • Executes dropped EXE
        PID:776

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a4de8.rbs
            • Path C:\Config.Msi\e5a4de8.rbs
            • Size 19KB
            • SHA256 7ea0f6e33e4a422623b024b6c61b0ec703673fced0b0900874962951ff71e516
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4df4.rbs
            • Path C:\Config.Msi\e5a4df4.rbs
            • Size 19KB
            • SHA256 291d60e24c7655c680440681eaa7f5918905410576df7375e7ff8ab37877f364
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4dfb.rbs
            • Path C:\Config.Msi\e5a4dfb.rbs
            • Size 21KB
            • SHA256 37b123f3da41d51a5117b69da3c4fd4cb92bd736927a9cb8d13790be67302f09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4e0a.rbs
            • Path C:\Config.Msi\e5a4e0a.rbs
            • Size 21KB
            • SHA256 881b93779ed36ed7d53f27ef5cd4eed13be77dc86432c48064c38403092c4670
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GalaxyClient.exe
            • Path C:\Program Files\GOG Galaxy\GalaxyClient.exe
            • Size 14.7MB
            • SHA256 c6f63ae1cad0136b693863fb2582ab8a0c4f30b77efc597d2743c687a3f4f3ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoData.dll
            • Path C:\Program Files\GOG Galaxy\PocoData.dll
            • Size 2.1MB
            • SHA256 970a5a0215dc51ee35f3e0ed3508feed50fa70b60fb9da27e9cdbc36ee500e99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoDataSQLite.dll
            • Path C:\Program Files\GOG Galaxy\PocoDataSQLite.dll
            • Size 404KB
            • SHA256 5fd3840b1464fce1bf95223a097c7a2c217389b5ca2cf893aec91741f3c4a6c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoFoundation.dll
            • Path C:\Program Files\GOG Galaxy\PocoFoundation.dll
            • Size 2.1MB
            • SHA256 dff145ef5117ffb273316685b4669220b0b31204f92be09e82691a73a9b955a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoJSON.dll
            • Path C:\Program Files\GOG Galaxy\PocoJSON.dll
            • Size 388KB
            • SHA256 45b48529aafda73c60959609910b18e34d198e7c898cace6969d907694d622a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoNet.dll
            • Path C:\Program Files\GOG Galaxy\PocoNet.dll
            • Size 1.5MB
            • SHA256 24b103f8e5ae714a5b41f697624b13211397fa72608375d4e5ff8aa35715aa98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PocoUtil.dll
            • Path C:\Program Files\GOG Galaxy\PocoUtil.dll
            • Size 595KB
            • SHA256 234111be57fbcae98f2eeae7b5b8340343a5529159f38b10799270932c28eca6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Core.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Core.dll
            • Size 6.1MB
            • SHA256 ee1ac4133cb8618f0154b497f31ab5916e02144833632b3c9e83f41bb2631026
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Gui.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Gui.dll
            • Size 8.3MB
            • SHA256 257be29c3263eae197bd666a34814874403e94a9f9659fe786811353ab597150
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Network.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Network.dll
            • Size 1.6MB
            • SHA256 e5dda85d26ce26d97dba94fcd8407989bd1dbfb4eaf9e2487ef5966b9fb942ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6WebChannel.dll
            • Path C:\Program Files\GOG Galaxy\Qt6WebChannel.dll
            • Size 244KB
            • SHA256 9a7d3454c4a582130b6c6afd81e71902e23c56707838bcdd9342a6474a448867
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6WebEngineWidgets.dll
            • Path C:\Program Files\GOG Galaxy\Qt6WebEngineWidgets.dll
            • Size 180KB
            • SHA256 6b94116ee0576c07ddd0966e2febbb983c925d136f45765abf3f45201d100e34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Widgets.dll
            • Path C:\Program Files\GOG Galaxy\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 e1155224f31d54a7c79286b0f8014d1ffd70af187fb297a6ad29d3b8f75ee68b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-52G8VGV0Z6.tmp
            • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\_websocket\is-52G8VGV0Z6.tmp
            • Size 18KB
            • SHA256 682d97f70917c59a8a09ba2759d2504c4f12a1f4ffd091a584a8f2f0bda4b7f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-8G18FLQJ1Z.tmp
            • Path C:\Program Files\GOG Galaxy\plugins\GalaxyPluginXbox\propcache\is-8G18FLQJ1Z.tmp
            • Size 14B
            • SHA256 6b2e4e30ee3be4f95c67f15bba7f666875bb63a3014e4d145cbe33b47c7722e8
            • MD5 SHA1 SHA512
            Submit Download

            sqlite.dll
            • Path C:\Program Files\GOG Galaxy\sqlite.dll
            • Size 1.1MB
            • SHA256 1875160d08be7a6bbe8989b1ba95738b2dffa3f444d5f2c93d8d797b9fc53da2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-L5U8FA5XUF.tmp
            • Path C:\Program Files\GOG Galaxy\web\is-L5U8FA5XUF.tmp
            • Size 27KB
            • SHA256 9d7f768138e6afa99714de21d61e6096a425fa168da6a6ed11e1c5356f438d91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            native.json
            • Path C:\Program Files\GOG Galaxy\web\locales\pt-PT\native.json
            • Size 1KB
            • SHA256 4b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            xdelta3.dll
            • Path C:\Program Files\GOG Galaxy\xdelta3.dll
            • Size 171KB
            • SHA256 01952a7e522f1e9caa2beccf9aaf930c312625a4565d6cfa35848ae6ae7fc6c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Program Files\GOG Galaxy\zlib1.dll
            • Size 130KB
            • SHA256 1ac2cc7abd9449d8fd98a27f2c3d61f6e71cca8680183765c1e29cefa1cac44c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-L0DHCQ23V4.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-L0DHCQ23V4.tmp
            • Size 40KB
            • SHA256 fac8bb4a19c265294393bebac2a25e825507de3d79e9e239f6decb8702f57926
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-R6YNBFMCXY.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\changelogs\is-R6YNBFMCXY.tmp
            • Size 54KB
            • SHA256 a54d17708ce3d7cb1f62a3e0b5481cb0ee78db2f14426328d00b2b5ab2238f18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            config.json
            • Path C:\ProgramData\GOG.com\Galaxy\config.json
            • Size 76B
            • SHA256 2aefc577403ac70840f9b32ba520fa5a1878cbf48713d63e365bf33e4391bc61
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\ProgramData\GOG.com\Galaxy\config.json
            • Size 336B
            • SHA256 69601f552336ec1d8c57ccc2a74c7e1e997fd072d382e2b974d0f53d2c4c68e4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\ProgramData\GOG.com\Galaxy\config.json
            • Size 401B
            • SHA256 7e04e1bff26f80c56784cccfb7d293db5b933c4f4169aaf172dfb16b1ca2f399
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            InstallerWebinstaller.log
            • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
            • Size 736B
            • SHA256 b9e44718877cd7144e07c8aae918ad7967aff6d8fbb4de11b1f3d1dab494f101
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            InstallerWebinstaller.log
            • Path C:\ProgramData\GOG.com\Galaxy\logs\InstallerWebinstaller.log
            • Size 4KB
            • SHA256 826bcd3a245b71a8f7887c5936d967fe60c52dfe710e550f2af783fed4b4a6ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-SMYY8TS6Y0.tmp
            • Path C:\ProgramData\GOG.com\Galaxy\redists\web\locales\en-US\is-SMYY8TS6Y0.tmp
            • Size 147KB
            • SHA256 1725e73ff0c952cdb0771da3424e6f119f65ca5700acec06c3b8bcf78406f959
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            f_00000b
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Cache\Cache_Data\f_00000b
            • Size 312KB
            • SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\Session Storage\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\TransportSecurity
            • Size 857B
            • SHA256 abf5abc142730759b2ec4a62f592fca02f0f1126b6c2e127d71366ea7b546b95
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5b1bc2.TMP
            • Path C:\ProgramData\GOG.com\Galaxy\webcache\common\TransportSecurity~RFe5b1bc2.TMP
            • Size 857B
            • SHA256 f94ee80bc20ef3f444dc65177f2a896af7fc6f4611449ab7e2bc9b249395ee32
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
            • Size 2KB
            • SHA256 1133c21dc8a6f4bd34ae1796220bb0583313a3c7df3956c98f01ecd99f2718cf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\GOG.com\Galaxy\Configuration\config.json
            • Size 3KB
            • SHA256 495e1eab13e7d6a0d568cfebe9e56905136ca07ba8707ae448cc4b374d4b77ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GalaxyInstaller.exe
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\GalaxyInstaller.exe
            • Size 607KB
            • SHA256 0fc3b42a96b6ac0fa20556bac1d6a58071436952cddd8655545dc24ff207a09a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon.ico
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\icon.ico
            • Size 520KB
            • SHA256 d09ccaf753e884a02976544208a33b72a17e74eba9a0254b355554752f4a267f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            payload.campaign
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\payload.campaign
            • Size 557B
            • SHA256 debaea8d2bca496705873e87cfee75c0cb80746772ebf33e90a53522dc0174f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            remoteconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_HtnjT\remoteconfig.json
            • Size 529B
            • SHA256 110ed2fc0245994dc44ccde50064e2e996864031309fc46b13369cdbec5e1099
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260826001036.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001036.log
            • Size 8KB
            • SHA256 821feb06be1e86f96cc5e4ef6e51809492af551841f65c827b171417c4e94b15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260826001036_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260826001036_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 dbcf0924b4af20cf658c0283698a176e5b85de1c8bff81485f0aaedeb28a5534
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GalaxySetup.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-B3WIQ4DFJC.tmp\GalaxySetup.tmp
            • Size 7.0MB
            • SHA256 3632388cb25f3ca257938519a1ef2bb9fbbe4c7ae7177e2c4694ac7b2fde8980
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _isdecmp.dll
            • Path C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\_isetup\_isdecmp.dll
            • Size 27KB
            • SHA256 231ae2fd793ab01ffb47611eb32cf64cdf5f447736cba4268b3e54875ff87330
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x64.exe
            • Size 17.9MB
            • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x86.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-UIW2WFE282.tmp\vc_redist.x86.exe
            • Size 6.7MB
            • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140.dll
            • Path C:\Windows\SYSTEM32\MSVCP140.dll
            • Size 627KB
            • SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x86.exe
            • Path C:\Windows\Temp\{0C3B24EF-15D0-40E0-AE9E-06DB219E3473}\.cr\vc_redist.x86.exe
            • Size 668KB
            • SHA256 746a6db1a22c0e3efb2bb7301c179a7201c462c55214b36c3f95639c55322fe8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{0D830232-08B7-4DC2-93A1-48E2E05848CA}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{0D830232-08B7-4DC2-93A1-48E2E05848CA}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{0D830232-08B7-4DC2-93A1-48E2E05848CA}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Windows\Temp\{B12E9EE9-7AA8-427A-BE8E-67FDD2C50977}\.cr\vc_redist.x64.exe
            • Size 669KB
            • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{E773BBE3-17F4-46EA-AC18-003BF5CFCAE0}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{E773BBE3-17F4-46EA-AC18-003BF5CFCAE0}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\cab5046A8AB272BF37297BB7928664C9503
            • Size 1.0MB
            • SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{ED56D5F4-B6DC-4AD8-B4AE-0E751353DF99}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2304-626-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/2304-2829-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/2304-2815-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/2304-2185-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/2304-2044-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/2304-2042-0x0000000000A40000-0x000000000114D000-memory.dmp
            Download

            memory/4424-41-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-46-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-40-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-32-0x000000001F330000-0x000000001F858000-memory.dmp
            Download

            memory/4424-34-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-33-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-15-0x00007FFAB4A8F000-0x00007FFAB4A90000-memory.dmp
            Download

            memory/4424-16-0x0000000000CC0000-0x0000000000D5C000-memory.dmp
            Download

            memory/4424-39-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-2836-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-31-0x000000001EC30000-0x000000001EDF2000-memory.dmp
            Download

            memory/4424-43-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-42-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-44-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-17-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-18-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-45-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4424-19-0x00007FFAB4900000-0x00007FFAB52A4000-memory.dmp
            Download

            memory/4488-2905-0x00007FFAD57C0000-0x00007FFAD57C1000-memory.dmp
            Download

            memory/4488-2904-0x00007FFAD6B80000-0x00007FFAD6B81000-memory.dmp
            Download

            memory/4488-3032-0x000001EC0D9A0000-0x000001EC0D9AA000-memory.dmp
            Download

            memory/4488-2906-0x00007FFAB0FF0000-0x00007FFAB1574000-memory.dmp
            Download

            memory/4608-625-0x0000000000CD0000-0x0000000000E9B000-memory.dmp
            Download

            memory/4608-61-0x0000000000CD0000-0x0000000000E9B000-memory.dmp
            Download

            memory/4608-2830-0x0000000000CD0000-0x0000000000E9B000-memory.dmp
            Download

            memory/4692-0-0x0000000000BB0000-0x0000000000D89000-memory.dmp
            Download

            memory/4740-2326-0x00007FFAAD8F0000-0x00007FFAADF37000-memory.dmp
            Download

            memory/4740-2325-0x00007FFAA8220000-0x00007FFAA87A4000-memory.dmp
            Download

            memory/4740-2323-0x00007FFA97720000-0x00007FFA98720000-memory.dmp
            Download

            memory/4892-2818-0x00007FFAAD8F0000-0x00007FFAADF37000-memory.dmp
            Download

            memory/4892-2819-0x00007FFAA8710000-0x00007FFAA8C94000-memory.dmp
            Download

            memory/4972-3029-0x00007FFAB1990000-0x00007FFAB1EFD000-memory.dmp
            Download

            memory/4972-2837-0x00007FFAB2D80000-0x00007FFAB33C7000-memory.dmp
            Download

            memory/4972-2838-0x00007FFAB0FF0000-0x00007FFAB1574000-memory.dmp
            Download