24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 7b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 690939ada9af… — Score 100/100 — Sample d1d6c46a8a9d…","description":"Malicious verdict for sandbox report 690939ada9af…. Threat score 100/100. 5 malicious and 24 suspicious behavioral indicators across 260 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/d1d6c46a8a9df6d0136c13dfb7df8a9774cea45ff8c96d3bd45f59ec26a1e5ae/690939ada9aff495330ff3f7","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","d1d6c46a8a9df6d0136c13dfb7df8a9774cea45ff8c96d3bd45f59ec26a1e5ae"],"about":{"@type":"SoftwareApplication","name":"GOG_Galaxy_2.0.exe","applicationCategory":"PE32 executable for MS Windows 5.01 (GUI), Intel i386, UPX compressed, 3 sections","identifier":"d1d6c46a8a9df6d0136c13dfb7df8a9774cea45ff8c96d3bd45f59ec26a1e5ae","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":5,"suspicious":24,"totalSignatures":260},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AVVVVVVVVVVVVVVVVVVVVX1VVVVVVVVVVVVVVVVVVVV9VVVVVVVVVVVVVVVVVVVVfVVVVVVVVVVVVVVVVVVVVX1VVVVVVVVVVVVVVVVVVVV9VVXVVVVVVVVVVVVVVVVVfVVdVVVVVVVVVVVVVVVVVX1VXVVVVVVVVVVVVVVVVVV9VdVVVVVVVVVVVVVVVVVVf3XVVXVVVVVVVVVVVVVVVX9dVVV1VVVVVVVVVVVVVVV/X1VXVVVVVVVVVVVVVVVVffd1d1VVVVVVVVVVVVVVVX43d3dVVXVVVVVVVVVVVVV+N3d3V3dXVVVVVVVVVVVVfjd3d3d3d3VVVVVVVVVVVX43d3d3d3d1VVVVVVVVVVV+N3d3d3d3dVVVVVVVVVVVfjd3d3d3d3d3dVVVVVVVVX43d3d3d3d3d3dVVVVVVVV/Y3d3d3d3d3d3VVVVVVVVf2N3d3d3d3d3d1VVVVVVVX9iN3d3d3d3d3dVVVVVVVV/djd3d3d3d3d3VXdVVVVVf3djd3d3d3d3d3d1VVVVVX93Yjd3d3d3d3d3VVVVVVV/d3Yjd3d3d3d3VVVVVdVVf3d3Yjd3d3d3d3VVVV1VVX93d3Yjd3d3d3d3VV3VVVV/d3d3diN3d3d3d13VVVVVf3d3d3d2Ijd3dd33VVVVVX93d3d3d3diIiN3d1VVVVV//4A///4AB//4AAP/4AAA/8AAAH+AAAA/gAAAHwAfAB4Af8AOAP/wDAH/+AQD//gEB//8BAf//AQH//wEB//8BAf//AQH//wEB//8BAf//AQD//gEAf/4BgD/8A4Af8APAB8AH4AAAD+AAAA/wAAAf/AAAP/4AAP//gAP//+AP/w==26:T674,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")27:T900,"GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "129" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "133" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "137" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "138" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "139" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "136" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "135" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "134" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "140" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "141" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "142" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "143" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "144" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "145" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "132" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "1" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "3" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "4" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "5" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "6" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "7" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "8" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "9" - (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00005040)28:Tc1a,"GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059312'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059352'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059512'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059552'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059592'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059472'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059432'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059392'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059632'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059672'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059712'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059752'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059792'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059832'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6059896'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058248'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058288'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058328'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058368'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058408'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058448'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058488'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058528'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058568'}" (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '6058608'}" (UID: 00000000-00005040)29:T96e,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")2a:T652,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "GOG_Galaxy_2.0.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005040.00000003.293266.005C7000.00000004.mdmp")2b:T6ac,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "GOG_Galaxy_2.0.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "GOG_Galaxy_2.0.exe") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "GOG_Galaxy_2.0.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "GOG_Galaxy_2.0.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "GOG_Galaxy_2.0.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")2c:T514,"GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3404103584 [PID: 5040] "GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3404111582 [PID: 5040] "GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3404283100 [PID: 5040] "GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3404291926 [PID: 5040] "GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3405811666 [PID: 5040] "GOG_Galaxy_2.0.exe" queried SystemProcessInformation at 00000000-00005040-00000C15-3405821067 [PID: 5040] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3408310518 [PID: 6884] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3408319344 [PID: 6884] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3408860251 [PID: 6884] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3408874764 [PID: 6884] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3409147004 [PID: 6884] "GalaxyInstaller.exe" queried SystemProcessInformation at 00000000-00006884-00000C15-3409154445 [PID: 6884]2d:T1449,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2722-0046A820 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2722-0046A820 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38 Assembly shows XOR instruction xor byte ptr [edi+14h] ah in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor byte ptr [ebx+14h] al in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor byte ptr [eax+14h] bl in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor byte ptr [edx+14h] dl in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor al ah in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor byte ptr [ebp-26h] 73h in Stream UID: 00000000-00005040-47000-2732-0046C36A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2746-0045A188 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2746-0045A188 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005040-47000-2769-0045F5D4 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005040-47000-2769-0045F5D4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2773-0045F878 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2773-0045F878 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2777-00467E37 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2777-00467E37 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005040-47000-2786-0045EFE4 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005040-47000-2786-0045EFE4 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005040-47000-2786-0045EFE4 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005040-47000-2786-0045EFE4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2908-00436786 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2908-00436786 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-2911-0043A370 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-2911-0043A370 Assembly shows XOR instruction xor esi dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2927-00432530 Assembly shows XOR instruction xor esi dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2944-00436457 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005040-47000-2975-00432575 Assembly shows XOR instruction xor esi dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3027-004326E9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3062-0045A542 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3062-0045A542 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005040-47000-3125-0044DD1B Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005040-47000-3125-0044DD1B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3233-00463769 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3233-00463769 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3256-004633E4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3256-004633E4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F Assembly shows XOR instruction xor eax dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3268-0045F50E2e:T1556,Contains base64 string in header "/components/webinstaller" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive" Contains base64 string in header "POST" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "1Content" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "application/jsonUser" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "7376" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "Host" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "insights" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1Host: content-system.gog.comConnection: Keep-Alive"2f:T404,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption30:Tacd,Found XOR loop in file "sample.bin" at offset 119396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 150146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 158219; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 201428; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 397253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 414576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 874393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 31140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 58493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 129667; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 199909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 278552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 335814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 359695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 378532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 400978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 729593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 808353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 39789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 57264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 130514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 147043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 166111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 186261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 191382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 217196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 233437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 270178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 947090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 972091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 973923; code bytes = 803031:T411,Found string "System.Identity.UserName" (Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "get_UserName" (Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "GetDrives" (Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00005040.00000003.293266.04B40000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00005040.00000003.293266.04B40000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00005040.00000003.293266.04B40000.00000002.mdmp") Found string "get_UserName" (Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found string "GetDrives" (Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp")32:T6ca,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")33:T44a,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")34:T4fa,"GOG_Galaxy_2.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040)35:T462,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")36:Ta55,"GalaxyInstaller.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "GalaxyInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")37:T91c,"GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")38:T533,"GOG_Galaxy_2.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "GOG_Galaxy_2.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")39:T8ce,"GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter 43003a00 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter C:/ProgramData (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\GOG.com (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy/logs (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy/logs/ (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\pt-BR (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\zh (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\fr (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\de (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\pl (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\ru (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\zh-Hant (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\ja (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\ko (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\es (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\es-MX (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "CreateDirectoryW" with parameter %TEMP%\GalaxyInstaller_EgtBu\it (UID: 00000000-00005040)3a:Tc45,"GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005040) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00006884) "GalaxyInstaller.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006884)3b:Ta774,"GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateTimerQueue (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SignalObjectAndWait (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetThreadPriority (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter CreateTimerQueueTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ChangeTimerQueueTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter DeleteTimerQueueTimer (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter UnregisterWait (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetThreadTimes (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ReleaseSemaphore (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter QueryDepthSList (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter UnregisterWaitEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetDateFormatW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetTimeFormatW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FindFirstFileExA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter SHFileOperationW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter URLDownloadToFileW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005040) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00006884) "GalaxyInstaller.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00006884)3c:T498,Sleep@KERNEL32.DLL at 00000000-00005040-47000-2839-00436565 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-2905-00436471 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-3031-0043ACF4 CreateTimerQueueTimer@KERNEL32.DLL at 00000000-00005040-47000-3035-004361F7 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-3831-0043370E WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-4252-004207AB Sleep@KERNEL32.DLL at 00000000-00005040-47000-4261-0041D88F Sleep@KERNEL32.DLL at 00000000-00005040-47000-4262-00420827 Sleep@KERNEL32.DLL at 00000000-00005040-47000-4511-0041C230 WaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-4748-00414A26 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5057-0043662A WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5133-00438266 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5289-0043E506 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5528-00448C97 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5536-00448CB3 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-8478-004475B33d:Tc554,Found reference to API (Indicator: "RegCloseKey"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "ExitProcess"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "VirtualProtect"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "MessageBoxW"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "URLDownloadToFileW"; File: "GOG_Galaxy_2.0.exe") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadIcon"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindResourceW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateTimerQueue"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SwitchToThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadPriority"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadPriority"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ChangeTimerQueueTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWait"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadTimes"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "QueryDepthSList"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleCP"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SHFileOperationW"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadIcon"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateTimerQueue"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ChangeTimerQueueTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWait"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetThreadTimes"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "QueryDepthSList"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "URLDownloadToFileW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005040.00000003.293266.005C7000.00000004.mdmp") Found reference to API (Indicator: "LoadIcon"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp")3e:T438,Found reference to API "LockResource" (Indicator: "LockResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")3f:T460,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")40:T15d8,"Software\WOW6432NODE\GOG.com\GalaxyClient\paths" in Source: 47000-3872-00407E84 "Software\GOG.com\GalaxyClient\paths" in Source: 47000-3872-00407E84 "Software\GOG.com\GalaxyClient" in Source: 47000-3872-00407E84 "Software\WOW6432Node\GOG.com\GalaxyClient" in Source: 47000-3872-00407E84 "Software\Microsoft\NET Framework Setup\NDP\v3.5" in Source: 47000-3895-00408152 "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 47000-3896-0040818B "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp 00000000-00005040.00000001.283921.029F0000.00000004.mdmp 00000000-00005040.00000002.285843.029F0000.00000004.mdmp 00000000-00005040.00000003.293266.029F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B." in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp 00000000-00005040.00000001.283921.029F0000.00000004.mdmp 00000000-00005040.00000002.285843.029F0000.00000004.mdmp 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp 00000000-00005040.00000001.283921.029F0000.00000004.mdmp 00000000-00005040.00000002.285843.029F0000.00000004.mdmp 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp 00000000-00005040.00000001.283921.029F0000.00000004.mdmp 00000000-00005040.00000002.285843.029F0000.00000004.mdmp 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.5" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\WOW6432NODE\GOG.com\GalaxyClient\paths" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\WOW6432Node\GOG.com\GalaxyClient" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\GOG.com\GalaxyClient" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp 00000000-00006884.00000001.284132.02D00000.00000004.mdmp 00000000-00006884.00000002.286051.02D00000.00000004.mdmp 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "HINE\Software\Microsoft\StrongName\Revo" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp 00000000-00006884.00000001.284132.02D00000.00000004.mdmp 00000000-00006884.00000002.286051.02D00000.00000004.mdmp 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp 00000000-00006884.00000001.284132.02D00000.00000004.mdmp 00000000-00006884.00000002.286051.02D00000.00000004.mdmp 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp 00000000-00006884.00000001.284132.214E0000.00000004.mdmp 00000000-00006884.00000002.286051.214E0000.00000004.mdmp 00000000-00006884.00000003.293281.02D00000.00000004.mdmp 00000000-00006884.00000003.293281.214E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp 00000000-00006884.00000001.284132.214E0000.00000004.mdmp 00000000-00006884.00000002.286051.214E0000.00000004.mdmp 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp 00000000-00006884.00000003.293281.214E0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp 00000000-00006884.00000002.286051.A4000000.00000004.mdmp 00000000-00006884.00000003.293281.A4000000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp 00000000-00006884.00000002.286051.A4000000.00000004.mdmp 00000000-00006884.00000003.293281.A4000000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp41:T6e0,"GOG_Galaxy_2.0.exe" with parameter 43003a00 (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter C:/ProgramData (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %ALLUSERSPROFILE%\GOG.com (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy/logs (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %ALLUSERSPROFILE%\GOG.com/Galaxy/logs/ (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\pt-BR (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\zh (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\fr (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\de (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\pl (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\ru (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\zh-Hant (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\ja (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\ko (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\es (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\es-MX (UID: 00000000-00005040) "GOG_Galaxy_2.0.exe" with parameter %TEMP%\GalaxyInstaller_EgtBu\it (UID: 00000000-00005040)42:T5c2,Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\GOG-WEBINSTALLERMUTEX" Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5040:168:WilStaging_02" Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5040:64:WilError_01" Process GOG_Galaxy_2.0.exe created mutex with name "Local\SM0:5040:64:WilError_01" Process GOG_Galaxy_2.0.exe created mutex with name "Local\SM0:5040:168:WilStaging_02" Process GOG_Galaxy_2.0.exe created mutex with name "Local\ZonesCacheCounterMutex" Process GOG_Galaxy_2.0.exe created mutex with name "SM0:5040:64:WilError_01" Process GOG_Galaxy_2.0.exe created mutex with name "GOG-WEBINSTALLERMUTEX" Process GOG_Galaxy_2.0.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process GOG_Galaxy_2.0.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process GOG_Galaxy_2.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5040:64:WilError_01" Process GalaxyInstaller.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6884:304:WilStaging_02" Process GalaxyInstaller.exe created mutex with name "Local\SM0:6884:304:WilStaging_02"43:T22d1,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B." in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B." in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B." in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\Microsoft\NET Framework Setup\NDP\v3.5" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\WOW6432NODE\GOG.com\GalaxyClient\paths" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\WOW6432Node\GOG.com\GalaxyClient" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\GOG.com\GalaxyClient" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000003.293266.029F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B." in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp "HINE\Software\Microsoft\StrongName\Revo" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp "HINE\Software\Microsoft\StrongName\Revo" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp "HINE\Software\Microsoft\StrongName\Revo" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "HINE\Software\Microsoft\StrongName\Revo" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp44:T20e0,file/memory contains long string with (Indicator: "mozilla/5.0 ("; File: "payload.campaign") file/memory contains long string with (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp")45:T6e6,"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: remote-config.gog.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 279 Server: nginx Content-Type: application/json Expires: Mon 03 Nov 2025 23:24:59 GMT Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish cache-control: max-age=120 x-origin-age: 0 x-date: Mon 03 Nov 2025 23:24:59 GMT Accept-Ranges: bytes Age: 0 Date: Mon 03 Nov 2025 23:25:00 GMT X-Served-By: cache-fra-etou8220185-FRA cache-lax-kwhp1940114-LAX X-Cache: MISS MISS X-Cache-Hits: 0 0 Vary: Accept-Encoding with response body ==>37623A32323A37363A36353A37323A37333A36393A36663A36653A32323A33613A32323A33323A32653A33303A32653A33303A32323A32633A32323A36333A36....... "GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1 Host: content-system.gog.com Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Connection: keep-alive Content-Length: 548 Server: nginx Content-Type: text/html; charset=UTF-8 Location: https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exe X-CACHE-ADN-TTL: 3600 Cache-Control: public max-age=3600 Via: 1.1 varnish 1.1 varnish x-origin-age: 2278 Accept-Ranges: bytes Age: 2278 Date: Mon 03 Nov 2025 23:25:04 GMT X-Served-By: cache-fra-etou8220199-FRA cache-lax-kwhp1940081-LAX X-Cache: HIT MISS X-Cache-Hits: 1940 0 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33.......46:T17a4,"GOG_Galaxy_2.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 756b0000 "GOG_Galaxy_2.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 756b0000 "GOG_Galaxy_2.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 756b0000 "GOG_Galaxy_2.0.exe" loaded module "KERNEL32" at base 75130000 "GOG_Galaxy_2.0.exe" loaded module "KERNEL32.DLL" at base 75130000 "GOG_Galaxy_2.0.exe" loaded module "ADVAPI32.DLL" at base 75890000 "GOG_Galaxy_2.0.exe" loaded module "SHELL32.DLL" at base 765e0000 "GOG_Galaxy_2.0.exe" loaded module "SHLWAPI.DLL" at base 752e0000 "GOG_Galaxy_2.0.exe" loaded module "URLMON.DLL" at base 73cc0000 "GOG_Galaxy_2.0.exe" loaded module "USER32.DLL" at base 74740000 "GOG_Galaxy_2.0.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 756b0000 "GOG_Galaxy_2.0.exe" loaded module "MSISO.DLL" at base 733b0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e80000 "GOG_Galaxy_2.0.exe" loaded module "PHONEINFO.DLL" at base 0 "GOG_Galaxy_2.0.exe" loaded module "RPCRT4.DLL" at base 74fd0000 "GOG_Galaxy_2.0.exe" loaded module "SSPICLI.DLL" at base 743d0000 "GOG_Galaxy_2.0.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 730c0000 "GOG_Galaxy_2.0.exe" loaded module "WINHTTP.DLL" at base 73010000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 730c0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73680000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72ff0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fa0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74a70000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72f30000 "GOG_Galaxy_2.0.exe" loaded module "MSKEYPROTECT.DLL" at base 72f20000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74460000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72e90000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74f70000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72e40000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72e40000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 748c0000 "GOG_Galaxy_2.0.exe" loaded module "CRYPTNET.DLL" at base 72e40000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72e20000 "GOG_Galaxy_2.0.exe" loaded module "WS2_32.DLL" at base 74a70000 "GOG_Galaxy_2.0.exe" loaded module "NTDLL.DLL" at base 779b0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73920000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75ec0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72cf0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 765e0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73cc0000 "GOG_Galaxy_2.0.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 756b0000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74320000 "GOG_Galaxy_2.0.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 72cb0000 "GalaxyInstaller.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa28f30000 "GalaxyInstaller.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa28f30000 "GalaxyInstaller.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa28f30000 "GalaxyInstaller.exe" loaded module "KERNEL32" at base 7ffa2c590000 "GalaxyInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "GalaxyInstaller.exe" loaded module "IPHLPAPI.DLL" at base 7ffa27fe0000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa28250000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa20690000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa20850000 "GalaxyInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "GalaxyInstaller.exe" loaded module "SECUR32.DLL" at base 7ffa1f510000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffa27da0000 "GalaxyInstaller.exe" loaded module "SSPICLI.DLL" at base 7ffa28920000 "GalaxyInstaller.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffa1a7a0000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffa1a330000 "GalaxyInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "GalaxyInstaller.exe" loaded module "CRYPT32.DLL" at base 7ffa29950000 "GalaxyInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa27e60000 "GalaxyInstaller.exe" loaded module "WS2_32.DLL" at base 7ffa2a000000 "GalaxyInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "GalaxyInstaller.exe" loaded module "COMCTL32.DLL" at base 7ffa17250000 "GalaxyInstaller.exe" loaded module "OLEAUT32.DLL" at base 7ffa29f30000 "GalaxyInstaller.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffa2aa20000 "GalaxyInstaller.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffa2aa20000 "GalaxyInstaller.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffa2a4c0000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffa2ad90000 "GalaxyInstaller.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffa2abb000047:T602,"GOG_Galaxy_2.0.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "GOG_Galaxy_2.0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "GOG_Galaxy_2.0.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "GOG_Galaxy_2.0.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "GOG_Galaxy_2.0.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "GOG_Galaxy_2.0.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "GOG_Galaxy_2.0.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "GOG_Galaxy_2.0.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "GOG_Galaxy_2.0.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "GOG_Galaxy_2.0.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "GOG_Galaxy_2.0.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")48:T675,"GOG_Galaxy_2.0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GOG_Galaxy_2.0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "GalaxyInstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "GalaxyInstaller.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")49:T66c,The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: AD:B1:59:DE:98:F5:DA:AC:D0:94:AB:BD:B4:10:15:5E:49:0C:31:88; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: DF:1C:BC:F2:B1:AF:03:6C:55:D1:22:A8:8A:27:19:D3:22:79:16:A8; see report for more information)4a:T555,"GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")4b:Tbef,"GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "GOG_GALAXY_2.0.EXE"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "GOG_GALAXY_2.0"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4c:T5b8,"GOG_Galaxy_2.0.exe" reads file "c:\gog_galaxy_2.0.exe" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\inetcache\ie\lscby323\webinstaller[1].json" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\appdata\local\temp\galaxyinstaller_egtbu\remoteconfig.json" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\music\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\links\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "GOG_Galaxy_2.0.exe" reads file "c:\users\desktop.ini" "GalaxyInstaller.exe" reads file "c:\users\%osuser%\appdata\local\temp\galaxyinstaller_egtbu\galaxyinstaller.exe.config" "GalaxyInstaller.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config"4d:T8e3,"GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GALAXYINSTALLER_EGTBU" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GalaxyInstaller_EgtBu" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\REMOTECONFIG.JSON" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\remoteconfig.json" "GOG_Galaxy_2.0.exe" trying to access non-existent file "\Device\RasAcd" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\GOGGALAXY.AUTH" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\gogGalaxy.auth" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GalaxyInstaller_EgtBu\GalaxyInstaller.exe:ZONE.IDENTIFIER" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GalaxyInstaller_EgtBu\GalaxyInstaller.exe:Zone.Identifier" "GOG_Galaxy_2.0.exe" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_GALAXYINSTALLER_EGTBU_B829B2429A02A704.CDF-MS" "GOG_Galaxy_2.0.exe" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\users_%OSUSER%_appdata_local_temp_galaxyinstaller_egtbu_b829b2429a02a704.cdf-ms" "GalaxyInstaller.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "GalaxyInstaller.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "GalaxyInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GALAXYINSTALLER.EXE.LOG" "GalaxyInstaller.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\GALAXYWEBINSTALLER" "GalaxyInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GalaxyInstaller_EgtBu\GALAXYINSTALLER.INI" "GalaxyInstaller.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "GalaxyInstaller.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GalaxyInstaller_EgtBu\GALAXYINSTALLER.EXE.LOCAL"4e:T5c1,Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found reference to API "DUnable to connect to GOG.com. Please check your internet connection." (Indicator: " connect "; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "DUnable to connect to GOG.com. Please check your internet connection." (Indicator: " connect "; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp")4f:T55c,"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive" "{"type": "galaxy_download_started", "date": "2025-11-03T23:25:01-08:00", "uuid": "5359e8a7-6f95-4442-a329-5c36d0623cc6", "meta": {"campaign": {"campaign":{"origin":"http://galaxy2-signup.gog.prod/en/?embeddable=true","origin_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0","unique_id":"1762212211-VIzNemO4a3XG0M8lTdK4PA=="},"login_parameters":"origin=http%3A%2F%2Fgalaxy2-signup.gog.prod%2Fen%2F%3Fembeddable%3Dtrue&origin_user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F142.0.0.0+Safari%2F537.36+Edg%2F142.0.0.0&unique_id=1762212211-VIzNemO4a3XG0M8lTdK4PA%3D%3D"}}, "data": {"current_version": "", "version": "2.0.90.23"}}" "HTTP/1.1 100 Continue" "HTTP/1.1 204 No ContentConnection: keep-aliveServer: nginxCache-Control: max-age=0, no-cache, no-store, privatex-origin-age: 0Accept-Ranges: bytesVia: 1.1 varnish, 1.1 varnishDate: Mon, 03 Nov 2025 23:25:04 GMTX-Served-By: cache-fra-etou8220152-FRA, cache-lax-kwhp1940033-LAXX-Cache: MISS, MISSX-Cache-Hits: 0, 0"50:T28f3,Heuristic match: "\(t,.cr" Heuristic match: "(\\].in" Heuristic match: "g6.az" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "http://galaxy2-signup.gog.prod/en/?embeddable=true,origin_user_agent:mozilla/5.0" Heuristic match: "remote-config.gog.com" Heuristic match: "insights-collector.gog.com" Heuristic match: "content-system.gog.com" Pattern match: "support.gog.com/hc/de" Heuristic match: "something went wrong while installing gog galaxy. please try again or contact support.gog.com" Heuristic match: "algo deu errado ao instalar o gog galaxy. por favor, tente novamente ou entre em contato com support.gog.com" Pattern match: "https://remote-config.gog.com/components/webinstaller?component_version=2.0.0" Pattern match: "gog.com/galaxy/logs/" Heuristic match: "upport.gog.com" Heuristic match: "support.gog.com" Heuristic match: "g.com" Heuristic match: "ovamente ou entre em contato com support.gog.com" Heuristic match: "er le support.gog.com" Heuristic match: "t wrong while installing gog galaxy. please try again or contact support.gog.com" Pattern match: "remote-config.gog.com/components/webinstaller/clients/" Pattern match: "galaxy-client-reports.gog.com/problem.php" Heuristic match: "hts-collector.gog.com" Heuristic match: ">>$this.name" Heuristic match: ">>backgroundworkerdownload.name" Heuristic match: ">>backgroundworkerrunsetup.name" Heuristic match: ">>buttonerrorexit.name" Heuristic match: "belerror.name" Heuristic match: "rogresssize.name" Heuristic match: "essstats.name" Heuristic match: "aybackground.name" Heuristic match: "oad.name" Heuristic match: "d.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "%allusersprofile%\gog.com" Pattern match: "gog.com/galaxy" Pattern match: "gog.com/galaxy/logs" Pattern match: "https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exex-cache-adn-ttl" Pattern match: "og.com/galaxy/" Pattern match: "gog.com/galaxy/logs/installerbootstrapper.log" Pattern match: "remote-config.gog.com/components/webinstaller?component_version=2.0.0" Heuristic match: "emote-config.gog.com" Heuristic match: "gog.com" Heuristic match: "og.com" Heuristic match: "ttps://login.live.com" Heuristic match: ".sni.global.fastly.net" Heuristic match: "ntrust.net" Heuristic match: "*.gog.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "essayer ou contacter le support.gog.com" Heuristic match: "z support.gog.com" Pattern match: "remote-config.gwent.cn/components/webinstaller/clients/" Heuristic match: "ttps://insights-collector.gog.com" Heuristic match: ">backgroundworkerdownload.name" Heuristic match: ">buttonerrorexit.name" Heuristic match: ">labelprogresssize.name" Heuristic match: ">labelprogressstats.name" Heuristic match: ">labelwelcome.name" Heuristic match: ">panelerrorgraybackground.name" Heuristic match: ">tabcontrolmain.name" Heuristic match: ">tabdone.name" Heuristic match: ">taberror.name" Pattern match: "support.gog.com/hc/en-us/articles/360010216193" Heuristic match: "qsomething went wrong. please try to download the installer again, if the problem persists contact support.gog.com" Heuristic match: "kf.gaeamobile.net" Pattern match: "www.digicert.com110/" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0n" Pattern match: "cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0o" Pattern match: "crl3.digicert.com/digicertassuredidca-1.crl08" Pattern match: "crl4.digicert.com/digicertassuredidca-1.crl0w" Pattern match: "cacerts.digicert.com/digicertassuredidca-1.crt0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Heuristic match: "algo deu errado. por favor, tente fazer download do instalador novamente, se o problema persistir, entre em contato com support.gog.com" Heuristic match: "me persiste, contactez support.gog.com" Heuristic match: "dgog.com" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "ext=.com" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "xyingog.com" Heuristic match: "xycontent-system.gog.com" Heuristic match: "ontent-system.gog.com" Heuristic match: "uibsegoeuisl.tt" Heuristic match: "

9iqmgvw,czcnew" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp") Found URL "http://galaxy2-signup.gog.prod/en/?embeddable=true" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005040.00000001.283921.029F0000.00000004.mdmp") Found URL "http://galaxy2-signup.gog.prod/en/?embeddable=true" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005040.00000002.285843.029F0000.00000004.mdmp") Found URL "https://remote-config.gog.com/components/webinstaller?component_version=2.0.0downloaded" - Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193xfailed" - Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193kthis" - Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193pnot" - Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193:download" - Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found URL "http://galaxy2-signup.gog.prod/en/?embeddable=true" - Source: "00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193xfailed" - Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193kthis" - Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193pnot" - Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found URL "https://support.gog.com/hc/en-us/articles/360010216193:download" - Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json11/03" - Source: "00000000-00006884.00000000.282210.047E0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/03" - Source: "00000000-00006884.00000000.282210.047E0000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006884.00000001.284132.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006884.00000002.286051.1EC90000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json11/03" - Source: "00000000-00006884.00000003.293281.047E0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/03" - Source: "00000000-00006884.00000003.293281.047E0000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")52:T585,Found string "POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 100 Continue" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found string "HTTP/1.1 204 No Content" (Indicator: "HTTP/1.1"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")53:T834,Found string "B+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "+ncalrpc:[OLE9B03EAC7D5369DF7F8347516653D]" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "B+ncalrpc:[OLEF5177E782F356B8A946" (Indicator: "ncalrpc"; Source: "00000000-00005040.00000003.293266.057C0000.00000004.mdmp") Found string "+ncalrpc:[OLE1EA064303C9DBDD6ADB202FB255F]" (Indicator: "ncalrpc"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")54:T9b8,Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")55:T11c3,Found string "\payload.base64" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "Failed to decode base64 token. Continuing with installation." (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "Failed to parse base64 token, error [{}]" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "EncodeBase64" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "d.base64" (Indicator: "base64"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005040.00000001.283921.04FF0000.00000002.mdmp") Found string "Failed to parse base64 token, error [{}]" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "\payload.base64" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "Failed to decode base64 token. Continuing with installation." (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "payload.base64" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "EncodeBase64" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")56:T9bb,Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006884.00000000.282210.00712000.00000002.mdmp")57:T49c,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005040.00000003.293266.00401000.00000040.mdmp")58:T6b1,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\GalaxyInstaller_EgtBu\GalaxyInstaller.exe" (Indicator: "\Device\"; Source: "00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp")59:Ta0e,"GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "GOG_Galaxy_2.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")5a:Tb85,"POST /clients/52138777094359967/events HTTP/1.1 Content-Type: application/json User-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro) Host: insights-collector.gog.com Content-Length: 786 Connection: Keep-Alive" with payload::==> "7b:22:74:79:70:65:22:3a:20:22:67:61:6c:61:78:79:5f:64:6f:77:6e:6c:6f:61:64:5f:73:74:61:72:74:65:64:22:2c:20:22:64:61:74:65:22:3a:20:22:32:30:32:35:2d:31:31:2d:30:33:54:32:33:3a:32:35:3a:30:31:2d:30:38:3a:30:30:22:2c:20:22:75:75:69:64:22:3a:20:22:35:33:35:39:65:38:61:37:2d:36:66:39:35:2d:34:34:34:32:2d:61:33:32:39:2d:35:63:33:36:64:30:36:32:33:63:63:36:22:2c:20:22:6d:65:74:61:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:7b:22:6f:72:69:67:69:6e:22:3a:22:68:74:74:70:3a:2f:2f:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:2f:65:6e:2f:3f:65:6d:62:65:64:64:61:62:6c:65:3d:74:72:75:65:22:2c:22:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:22:3a:22:4d:6f:7a:69:6c:6c:61:2f:35:2e:30:20:28:57:69:6e:64:6f:77:73:20:4e:54:20:31:30:2e:30:3b:20:57:69:6e:36:34:3b:20:78:36:34:29:20:41:70:70:6c:65:57:65:62:4b:69:74:2f:35:33:37:2e:33:36:20:28:4b:48:54:4d:4c:2c:20:6c:69:6b:65:20:47:65:63:6b:6f:29:20:43:68:72:6f:6d:65:2f:31:34:32:2e:30:2e:30:2e:30:20:53:61:66:61:72:69:2f:35:33:37:2e:33:36:20:45:64:67:2f:31:34:32:2e:30:2e:30:2e:30:22:2c:22:75:6e:69:71:75:65:5f:69:64:22:3a:22:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:3d:3d:22:7d:2c:22:6c:6f:67:69:6e:5f:70:61:72:61:6d:65:74:65:72:73:22:3a:22:6f:72:69:67:69:6e:3d:68:74:74:70:25:33:41:25:32:46:25:32:46:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:25:32:46:65:6e:25:32:46:25:33:46:65:6d:62:65:64:64:61:62:6c:65:25:33:44:74:72:75:65:26:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:3d:4d:6f:7a:69:6c:6c:61:25:32:46:35:2e:30:2b:25:32:38:57:69:6e:64:6f:77:73:2b:4e:54:2b:31:30:2e:30:25:33:42:2b:57:69:6e:36:34:25:33:42:2b:78:36:34:25:32:39:2b:41:70:70:6c:65:57:65:62:4b:69:74:25:32:46:35:33:37:2e:33:36:2b:25:32:38:4b:48:54:4d:4c:25:32:43:2b:6c:69:6b:65:2b:47:65:63:6b:6f:25:32:39:2b:43:68:72:6f:6d:65:25:32:46:31:34:32:2e:30:2e:30:2e:30:2b:53:61:66:61:72:69:25:32:46:35:33:37:2e:33:36:2b:45:64:67:25:32:46:31:34:32:2e:30:2e:30:2e:30:26:75:6e:69:71:75:65:5f:69:64:3d:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:25:33:44:25:33:44:22:7d:7d:2c:20:22:64:61:74:61:22:3a:20:7b:22:63:75:72:72:65:6e:74:5f:76:65:72:73:69:6f:6e:22:3a:20:22:22:2c:20:22:76:65:72:73:69:6f:6e:22:3a:20:22:32:2e:30:2e:39:30:2e:32:33:22:7d:7d" HTTP/1.1 204 No Content Connection: keep-alive Server: nginx Cache-Control: max-age=0 no-cache no-store private x-origin-age: 0 Accept-Ranges: bytes Via: 1.1 varnish 1.1 varnish Date: Mon 03 Nov 2025 23:25:04 GMT X-Served-By: cache-fra-etou8220152-FRA cache-lax-kwhp1940033-LAX X-Cache: MISS MISS X-Cache-Hits: 0 0 with no response body5b:T979,Connection: Keep-Alive" with payload::==> "7b:22:74:79:70:65:22:3a:20:22:67:61:6c:61:78:79:5f:64:6f:77:6e:6c:6f:61:64:5f:73:74:61:72:74:65:64:22:2c:20:22:64:61:74:65:22:3a:20:22:32:30:32:35:2d:31:31:2d:30:33:54:32:33:3a:32:35:3a:30:31:2d:30:38:3a:30:30:22:2c:20:22:75:75:69:64:22:3a:20:22:35:33:35:39:65:38:61:37:2d:36:66:39:35:2d:34:34:34:32:2d:61:33:32:39:2d:35:63:33:36:64:30:36:32:33:63:63:36:22:2c:20:22:6d:65:74:61:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:7b:22:6f:72:69:67:69:6e:22:3a:22:68:74:74:70:3a:2f:2f:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:2f:65:6e:2f:3f:65:6d:62:65:64:64:61:62:6c:65:3d:74:72:75:65:22:2c:22:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:22:3a:22:4d:6f:7a:69:6c:6c:61:2f:35:2e:30:20:28:57:69:6e:64:6f:77:73:20:4e:54:20:31:30:2e:30:3b:20:57:69:6e:36:34:3b:20:78:36:34:29:20:41:70:70:6c:65:57:65:62:4b:69:74:2f:35:33:37:2e:33:36:20:28:4b:48:54:4d:4c:2c:20:6c:69:6b:65:20:47:65:63:6b:6f:29:20:43:68:72:6f:6d:65:2f:31:34:32:2e:30:2e:30:2e:30:20:53:61:66:61:72:69:2f:35:33:37:2e:33:36:20:45:64:67:2f:31:34:32:2e:30:2e:30:2e:30:22:2c:22:75:6e:69:71:75:65:5f:69:64:22:3a:22:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:3d:3d:22:7d:2c:22:6c:6f:67:69:6e:5f:70:61:72:61:6d:65:74:65:72:73:22:3a:22:6f:72:69:67:69:6e:3d:68:74:74:70:25:33:41:25:32:46:25:32:46:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:25:32:46:65:6e:25:32:46:25:33:46:65:6d:62:65:64:64:61:62:6c:65:25:33:44:74:72:75:65:26:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:3d:4d:6f:7a:69:6c:6c:61:25:32:46:35:2e:30:2b:25:32:38:57:69:6e:64:6f:77:73:2b:4e:54:2b:31:30:2e:30:25:33:42:2b:57:69:6e:36:34:25:33:42:2b:78:36:34:25:32:39:2b:41:70:70:6c:65:57:65:62:4b:69:74:25:32:46:35:33:37:2e:33:36:2b:25:32:38:4b:48:54:4d:4c:25:32:43:2b:6c:69:6b:65:2b:47:65:63:6b:6f:25:32:39:2b:43:68:72:6f:6d:65:25:32:46:31:34:32:2e:30:2e:30:2e:30:2b:53:61:66:61:72:69:25:32:46:35:33:37:2e:33:36:2b:45:64:67:25:32:46:31:34:32:2e:30:2e:30:2e:30:26:75:6e:69:71:75:65:5f:69:64:3d:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:25:33:44:25:33:44:22:7d:7d:2c:20:22:64:61:74:61:22:3a:20:7b:22:63:75:72:72:65:6e:74:5f:76:65:72:73:69:6f:6e:22:3a:20:22:22:2c:20:22:76:65:72:73:69:6f:6e:22:3a:20:22:32:2e:30:2e:39:30:2e:32:33:22:7d:7d" HTTP/1.1 204 No Content5c:T979,Connection: Keep-Alive" with payload::==> "7b:22:74:79:70:65:22:3a:20:22:67:61:6c:61:78:79:5f:64:6f:77:6e:6c:6f:61:64:5f:73:74:61:72:74:65:64:22:2c:20:22:64:61:74:65:22:3a:20:22:32:30:32:35:2d:31:31:2d:30:33:54:32:33:3a:32:35:3a:30:31:2d:30:38:3a:30:30:22:2c:20:22:75:75:69:64:22:3a:20:22:35:33:35:39:65:38:61:37:2d:36:66:39:35:2d:34:34:34:32:2d:61:33:32:39:2d:35:63:33:36:64:30:36:32:33:63:63:36:22:2c:20:22:6d:65:74:61:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:20:7b:22:63:61:6d:70:61:69:67:6e:22:3a:7b:22:6f:72:69:67:69:6e:22:3a:22:68:74:74:70:3a:2f:2f:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:2f:65:6e:2f:3f:65:6d:62:65:64:64:61:62:6c:65:3d:74:72:75:65:22:2c:22:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:22:3a:22:4d:6f:7a:69:6c:6c:61:2f:35:2e:30:20:28:57:69:6e:64:6f:77:73:20:4e:54:20:31:30:2e:30:3b:20:57:69:6e:36:34:3b:20:78:36:34:29:20:41:70:70:6c:65:57:65:62:4b:69:74:2f:35:33:37:2e:33:36:20:28:4b:48:54:4d:4c:2c:20:6c:69:6b:65:20:47:65:63:6b:6f:29:20:43:68:72:6f:6d:65:2f:31:34:32:2e:30:2e:30:2e:30:20:53:61:66:61:72:69:2f:35:33:37:2e:33:36:20:45:64:67:2f:31:34:32:2e:30:2e:30:2e:30:22:2c:22:75:6e:69:71:75:65:5f:69:64:22:3a:22:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:3d:3d:22:7d:2c:22:6c:6f:67:69:6e:5f:70:61:72:61:6d:65:74:65:72:73:22:3a:22:6f:72:69:67:69:6e:3d:68:74:74:70:25:33:41:25:32:46:25:32:46:67:61:6c:61:78:79:32:2d:73:69:67:6e:75:70:2e:67:6f:67:2e:70:72:6f:64:25:32:46:65:6e:25:32:46:25:33:46:65:6d:62:65:64:64:61:62:6c:65:25:33:44:74:72:75:65:26:6f:72:69:67:69:6e:5f:75:73:65:72:5f:61:67:65:6e:74:3d:4d:6f:7a:69:6c:6c:61:25:32:46:35:2e:30:2b:25:32:38:57:69:6e:64:6f:77:73:2b:4e:54:2b:31:30:2e:30:25:33:42:2b:57:69:6e:36:34:25:33:42:2b:78:36:34:25:32:39:2b:41:70:70:6c:65:57:65:62:4b:69:74:25:32:46:35:33:37:2e:33:36:2b:25:32:38:4b:48:54:4d:4c:25:32:43:2b:6c:69:6b:65:2b:47:65:63:6b:6f:25:32:39:2b:43:68:72:6f:6d:65:25:32:46:31:34:32:2e:30:2e:30:2e:30:2b:53:61:66:61:72:69:25:32:46:35:33:37:2e:33:36:2b:45:64:67:25:32:46:31:34:32:2e:30:2e:30:2e:30:26:75:6e:69:71:75:65:5f:69:64:3d:31:37:36:32:32:31:32:32:31:31:2d:56:49:7a:4e:65:6d:4f:34:61:33:58:47:30:4d:38:6c:54:64:4b:34:50:41:25:33:44:25:33:44:22:7d:7d:2c:20:22:64:61:74:61:22:3a:20:7b:22:63:75:72:72:65:6e:74:5f:76:65:72:73:69:6f:6e:22:3a:20:22:22:2c:20:22:76:65:72:73:69:6f:6e:22:3a:20:22:32:2e:30:2e:39:30:2e:32:33:22:7d:7d" HTTP/1.1 204 No Content5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AVVVVVVVVVVVVVVVVVVVVX1VVVVVVVVVVVVVVVVVVVV9VVVVVVVVVVVVVVVVVVVVfVVVVVVVVVVVVVVVVVVVVX1VVVVVVVVVVVVVVVVVVVV9VVXVVVVVVVVVVVVVVVVVfVVdVVVVVVVVVVVVVVVVVX1VXVVVVVVVVVVVVVVVVVV9VdVVVVVVVVVVVVVVVVVVf3XVVXVVVVVVVVVVVVVVVX9dVVV1VVVVVVVVVVVVVVV/X1VXVVVVVVVVVVVVVVVVffd1d1VVVVVVVVVVVVVVVX43d3dVVXVVVVVVVVVVVVV+N3d3V3dXVVVVVVVVVVVVfjd3d3d3d3VVVVVVVVVVVX43d3d3d3d1VVVVVVVVVVV+N3d3d3d3dVVVVVVVVVVVfjd3d3d3d3d3dVVVVVVVVX43d3d3d3d3d3dVVVVVVVV/Y3d3d3d3d3d3VVVVVVVVf2N3d3d3d3d3d1VVVVVVVX9iN3d3d3d3d3dVVVVVVVV/djd3d3d3d3d3VXdVVVVVf3djd3d3d3d3d3d1VVVVVX93Yjd3d3d3d3d3VVVVVVV/d3Yjd3d3d3d3VVVVVdVVf3d3Yjd3d3d3d3VVVV1VVX93d3Yjd3d3d3d3VV3VVVV/d3d3diN3d3d3d13VVVVVf3d3d3d2Ijd3dd33VVVVVX93d3d3d3diIiN3d1VVVVV//4A///4AB//4AAP/4AAA/8AAAH+AAAA/gAAAHwAfAB4Af8AOAP/wDAH/+AQD//gEB//8BAf//AQH//wEB//8BAf//AQH//wEB//8BAf//AQD//gEAf/4BgD/8A4Af8APAB8AH4AAAD+AAAA/wAAAf/AAAP/4AAP//gAP//+AP/w==5e:T12a24,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuydf6jm89rvr6ZpkiZJ0zRJkyZpkiRH0uQ4kyQ50iRJ2mmS5EiS9pE0TSZJkhw5kjyS5Mgjx2N7bBvbspy9t/3YtkeSpJ007SRJkiRJc2bNPfOd6/36fL/Xve5Z6557Ztb73euP7/X5/fl87zX39V7L/uw488zIRHyiiFatEibS228LcaIS12R2747MHlXER8qDmXPOiUzEx8plwtrI/PqrEHGv8ksGq7r22shEvJJZty4ycbbw9NPCiy8KzUvZKewdLXOcskqJqzIbNkQm4s0M3kJsUeJq5QXlNeX1zMsvRybiusyXX0Ym4k/Kr5n7749MbFLqw9F3FPFQZv36yMQa4bjjBHyemx8reWUXXBCZ+Jd/Ef7n/xT+638V/tt/E2qde64wNye89ZaAH1Hwr/8q/OEPwquvCqh98kkBH3dM9Prrwp/+JPy//ydgR3/9q4C+//EfwrvvCn/5izA/L6AWE/35zwL6grovarHmehndXkbUO8LR1cvAUH/7m4CXgsZ4v3gpaIwt1BvEUKjFyFikjnzntv+euVu15z9CeOmlDH/oSs1ZltUn/qhYlnWY1WSuNoQ2hDaENoQNNoQZTGRDePQbwkv+xyUde01gDveaQAlfeimHe3/OFh/uTXwdOnTYhvjusizrcKvJXG0IbQhtCG0IG2wIM5jIhtCGcHFhnRM7dLhiQ3x3WZZ1uNVkrjaENoQ2hDaEDTaEGUxkQ2hDuLiwzokdOlyxIb67LMs63GoyVxtCG0IbQhvCBhvCDCayIbQhXFxY58QOHa7YEN9dlmUdbj34oPDmm8IDDwi7dgkRX2RuvTUy338vXH65sGaNEPF15rXXInPxxULE7cJeJ5M4+WQBSW+cL2zeLKB20yYhzlTiGeVh5dbMRx9FZu1aARb3oosiExcosU25TbgwMvQe5wrffivA8H/6qfDww0LE9xlOpC804tXMF19EBtY64glll3Jj5s47I/P888Jllwn85Khrxac94orMe+9FJs5S4rkMcuDGeN8hYGgkwQBpLlLzOkVG0o9VYijM+/77AoaqJ6q3gNp33hFwOEjrMVFtcrBIDIUN4iTrg8WOUAtgzOq+WCROA42xSJwkJsJ+MRGGgi+dyFrX7wgfwnqo+iNan0b5UzZnWdZMNcpILcuamWwIbQhtCG0IbQi5QZxkfbDYEWqBDeERaQiLv104dOhw2uEoI7Usa2ayIbQhtCG0IbQh5AZxkvXBYkeoBTaENoQOHTrUcJSRWpY1M9kQ2hDaENoQ2hBygzjJ+mCxI9QCG0IbQocOHWo4ykgty5qZbAhtCG0IbQhtCLlBnGR9sNgRaoENoQ2hQ4cONRxlpJZlzVBy/WPEB8pFyvWZp/WywIjvFDE5EV9meOsmrn88T3jpJaFJ3N9Wdig3CWvlWlFcWYmbM5vrLh9XXlYuVa5UYEWuE06NzO23C9ddJzQHi6sy/5LBnau8kxMWVw/nmWcE3m6qzrPZvlzQit8O4HWfcYYQ8U6G9hhvYX0I+rqbvnrsao8jLlZuyHALm4SffxbidAG/pOAHGGlunfQjy0ctfv9ROyJQp9dIzZFt141Ri1VhqLoWZ1Uvo7UuGfStfRpWVdfiDQIsAzvCUPXIWHO9QRwOavG5wocBI6MWW0At1oxlwJdiImy/Hhm17ell9A3OWZY1U8URo/m9/5YuQfP71D3nql7l9llD5UepNv/3zQVsbc1INoQ2hDaENoQ2hPMCtoBV1bV4gwDLwI4wVD0y1lxvEIeD2hVvCIu/XTh06HDaYYzTyCB1YnVSXdtpaMCx3esGhzxU27gtOXpVuL6iqlPz35H1FI6k/US9zXJhLkctCnOYS7r2bS+oHbO3S295b0kOD1k2hDaENoQ2hDaE8wK2gFXVtXiDAMvAjjBUPTLWXG8Qh4NaG8LhVNWhQ4fTDmOc4I4Ks1RUZQ0NOLZ73SDX1i1jXOO25OjVyPX1/m1wkYZw8WGvhroMlS/yGSXFaNDQgIt8XvxEE8mG0IbQhtCG0IZwXsAWsKq6Fm8QYBnYEYaqR8aa6w3icFBrQzicqjp06HDaYYwT3NEobAuzestzYfecQ7TpNFSShcIcth1zSVbXZdQmh0evZmsIiwZDQ7VdDqGqbdlpqEunthxdcoO28aHJhtCG0IbQhtCGcF7AFrCquhZvEGAZ2BGGqkfGmusN4nBQa0M4nKo6dOhw2mGMU69TWmRhV4Ln/S00HGrcNmiFqqHuvUOh70i9hUejbAihoS6d2nJ0yQ3axoemXzK4CxR3Nu5RxZYQThO2bROQ5V97bWTuuUeI1RWPPio8+6xAwxA/Zpi4xyeZrVsj8+STQsRTyveCXnYa8XGmGeqFzKpVkYnjla3KZiXeE/T2y0suEXC954knChF/yqxfH5k4R9EXumVLZCLuVB7O/PprZHhR6ikhxM0Z3Ne6e7fQXP16T+brryMTa4TmStK3MrhEN84WrrhCuOoqAdaaE8FdAGTqyONxOSTyaYCR3y1T8zKB5sjIxWuHUC8DI2ODWBX6wiGgMTaIvlhzfXR7v6QzmKg+HLxBrKq+dROLrBvX54yh0Bi12EJ9sDgcvBS8UIyMWvStDxbLwDlj+7qFOcuyZqoYp3lVLh96qMP9Ax1Qb4OusCjPWmSX3vLeYXsLj0Yt3RCK+2hqUQLlBhikC3PhqLx7RkldlaWtRMVoI7XlbZf2YYmyIbQhtCG0IbQh1DXXR7f3SzqDierDwRvEqmqPh0XWjetzxlBojFpsoT5YHM5RYgiLv104dOhw2mGME6xRFxYPXQj1Nus01GCoPKvoAqEBnjv1Fh6NWroh7H0eKoHaBl3J0MiL7IKStmpIY7u05b1dRs9t40OTDaENoQ2hDaENoa65Prq9X9IZTFQfDt4gVlV7PCyyblyfM4ZCY9RiC/XB4nBsCB06dDgujHGCNcrh6LkrKVpmjS0fGmeoYzRVY7vk8t42vYVHo5bREI4NW7UNupKhoRbfJZe0VUMa26Ut7+0yem4bH5psCG0IbQhtCG0Idc310e39ks5govpw8AaxqtrjYZF14/qcMRQaoxZbqA8Wh2ND6NChw3FhjBOsUQ7n96m3ahT21qJZp9xg6Hn00Ktc29sd5W1hUXL0qnB9RVUnGJ467NVQl6Hy+nkoXMxKRioGn+h5FC5+3lo2hDaENoQ2hDaEuub66PZ+T2cwUX04eINYVe3xsMi6cX3OGAqNUYst1AeLw7EhdOjQ4bgwxmle1dbmZ7TpSlDYPWctpiNKstAyP7cdexv01h7tav82iL8T1moNTy5pa3sl/iUVpiYsadujHLVtyyGhZTtUUd6GbcdDkua1vO/xOGWj8PLLAhvrlaR33x0ZpPU0GzCBvEnyN8rPJZcrNyq3KLuUhzJITpqLQ7cpYicam3pV5iJehvmicoeiV2XqG4Tjfe01IeLWzHnnRYZvkBZ3p7BVbaqaSXienTuFiAeUl5QdmU8/jUzEV5mHHooM/DDvEb0QN6PqSeqn7tRThYjnM03th5nuZ3ikjRsjA4vLXHyUsHbUST8+lMjUARJoDFVn6sjF0RfJ996vsQw+hajFUDiN2gNggxgKDgEmB30xL3w4Rq4Pp67FvEuprReJF4p3hKEAhsLh4CTRGJ9YbKF+g/g8Y976046Rsapyg3OWZc1UsTQdOd5pfp9YOrmWaxzLWrRsCG0IbQhtCN9t/AMaI61HXxvCYpGoxbxLqa0XaUOYKTc4V/7twqFDh9MOYwmycbKs5ZANoQ2hDaEN4buNf0BjpPXoa0NYLBK1mHcptfUibQgz5QbrVNWhQ4fTDuOQNL9PLLVWsJB97Vme/5ZySeKCjoAlDciG0IbQhtCG8N3GP6Ax0nr0tSEsFolazLuU2nqRNoSZcoN1qurQocNph2FZ1oxlQ2hDaENoQ/hu4x/QGGk9+toQFotELeZdSm29SBvCTLnBOlV16NDhtMOwLGu2+uEHIeIi5ScFrkZZG0Lcr3wh7HWbmbgkc8cdkUFWcOWVwrp1Ah3gGr1MMp5QLhY2qulVQ/jdd5GBX8KaaTX3ROb77wX4B5iN668XIq4puP/+yNAvrROOP15AusV51S+99JKwerXAz0Zcm3nwwcjgalDcbfvKKwKcZ8Q3ih7IqSHEXZnzz4/M5s0C3u+HHwoRLwv88P9F4DK+F5DIgjonRi2S7zoXR8aMkUE9VL1mUNuYMnHnMiaqhSPCmmGfsH00rkdGXzRuDySDLbQNMlhVfXRYJGphnjFR3Rf7rRvjnDEvtl/vqN4+VoWR1dPOWZY1U4VlWbOVDaENoQ2hDWFPWg/qoeo1AxvCAmyhbZDBquqjwyJRu+INYfG3C4cOHU47jHGaPyA/z/zZOjZlQ2hDaENoQ9iT1oN6qHrNwIawAFtoG2SwqvrosEjU2hAOp6oOHTqcdhiWZc1WNoQ2hDaENoQ9aT2oh6rXDGwIC7CFtkEGq6qPDotErQ3hcKrq0KHDaYdhWdZsZUNoQ2hDaEPYk9aDeqh6zcCGsABbaBtksKr66LBI1NoQDqeqDh06nHYYlmXNVki+I97LnHRSZD7+WIj4WhFTd8opkaG70Csr16+PDPo2NlX8Q8SDiniPJhe/LoOMIjYpJwvnnitEPJvBZZivvy7AxJ58soBr+XBR6qOPRga1994bmebGzqczONhbbhHWrhVwRSfePm5G/eYbARelXnNNZHDNJo7uhhuEiDsFvCPcFIoPwwUhxA+Zp56KDD78mzZFJuLtDD4Mq1YJ/BDGOxn4f6bIddKP2jqPRwKNnHhuTkACjfQaI8/PC6gFWCRWhaEAto9F1mtGLVaFH9H6nGFysCOsGedcWhHOWx97d2gjMBT2W49c85//KdRDYd52yxl82rGjeiKAxnhHOBzMq33nLMuaqaIUvjQhtraOPOnfRIh1RMiGMEOzYUNoQ2hDOAIjwwKhFtgQZmwIj0hDWPztwqFDh9MOoxS+NCG27tMi2+dmXcveQmsiFadWVHXCKxj7FsY2KDTRRLGIucY2OFJkQ5ih2bAhtCG0IRyBkWGBUAtsCDM2hDaEDh061DBK4UsTYus+dc3q9r21vYXWRBqd4J6GrqrWpK9g0vZZ6LuUoUZa+giHSTaEGZoNG0IbQhvCERgZFgi1wIYwY0NoQ+jQoUMNoxS+NCG2boQ2o3AxhSP1FloTaXSCexq6qlpDr6B7a/mT0IW5pG2Wq4qSHHYjoDA/oEEXdiVHrmwIMzQbNoQ2hDaEIzAyLBBqgQ1hxobQhtChQ4caRil8aUJs3QhturB4yOottCbS6AT3NHRVtYZeAT4AQ+8xN2urctiW5I5Dz20hyrvCI1t6dSSMCpL+iKuUPwm4aHG9gJsFX3xRwG2fsKm8KlOT/pdfjsyuXULErcLeZD1xzz3Cc88JEW8J2jfifeHEEE5R4q+K+OHrrosMrMjDDws8Z7039cILI9OY9g8zGPnLL4VHHhGatw/P84JwVmROO02IuEmRvrt3R4ZXv67BtbEXZehpqd8I50cGv/6IuCIDSx/xcAaethnqTUWPDnaiznphRZAEI70GGAoTIYGul1GbHNgYrBkjYwv1flH7hz8Ir74qvPWWgNPAr2Ha4yqODrXYEahNHdwUanHOaAyTgw8S5sV+//53oT6NepEAa8aqcJL1wQLsqD5YgFX98Y+ZOcuyZip8VUOjVHtIbN0Ibbqw9yGrKLQm0ujU9jR0VbXwCrq30D0gHCpHiPKuMCuXp1Y9g4xtcMTLhtCG0IbQhvDPNoTNcRVHh1rsCNS+pfZaOGcbwoK2fQaragxh8bcLhw4dTjvEVzWUE/RWbN0IbXKIEXpH6y20JtLoBPc0dFW1hl7B0JsdKkfYO2xvYTTl7SBjGxzxsiG0IbQhtCH8sw1hc1zF0aEWOwK1b6m9Fs7ZhrCgbZ/BqmwIHTo8kkJ8VUN7SrF1I7TpwuIhq7fQmkijE9zT0FXVGnoFY99sb9iVtOVDhdGUt3ONbXDEy4bQhtCG0IbwzzaEzXEVR4da7AjUvqX2WjhnG8KCtn0Gq7IhdOjwSArxVQ3tKcXWfeqa5fZtYe9ovYXWRCpOsKjqNPQKUD70HtvuxSenKM/jt3MNTTo04JEnG0IbQhtCG8I/2xA2x1UcHWqxI1D7ltpr4ZxtCAva9hmsyobQocMjKcRXNTTKv4fE1n1q26PjKOwdrbfQmkh7SsYqv76RunI06x6KZkVhDJeHLiMX4qEtR5cjVHfdJcTpwpYtAhwRPN7VVwv4so7YJRwXmVWrhLhQiUuV+xQZ+Z//jEzEoxkkNqtXC3GOsHmzEHF/Bt4DvjTi5cxNN0Um4h7lxczdd0fm0ksFbPCDD4SIjxVxrdu3Rya2Co89JsQ6obnOVGz5b34TGdxQSrdMeywHe/nlkVm3TqC33KDojuIM4YUXBHyeI75XvlIeyNx5Z2TwMcOPRsRzyg0CUlVk+fBLbR6cQXpd5/HwALh1E/PWi8TIWBUaoxYToTF2BK+FLQDYxXoZb7wh/O53Qu0usCo0nuil4DQm8nhqcrjf+mDrNWO/r70mYBn1ItuVFKtCLY4OtTgrvBTcqaurmrMsa6YKyzq8Ogoc2mGWDaENYYcNoQ2hDaENYc+asd9j0RAWf7tw6NDhtMOwrMMou8Ee2RDaEHbYENoQ2hDaEPasGfu1IXTo0OGyhmFZh0VHx3+9ORPZENoQdtgQ2hDaENoQ9qwZ+7UhdOjQ4bKGYVnWbGVDaEPYYUNoQ2hDaEPYs2bs14bQoUOHyxqGZVmz1nblpgyunfzwQwG2DXdj0mry1k1NvlfrfafxWuYiXnb6UQb+4bzzBJgreI9PPonMffcJ2O/ttwu4Jun664WIbzKwizt2CDyrM5WtitoY3G8Z8UkGGdSJJwqxRvj+ewFeC5bvySeFyy4TIt5RxNKvWRMZXEj70UcCj11HhvXCG4yzFbVtzz4bGRjvOF745hvhlFMEnCRS4ohPhVNDePNNAVv6/e8F1CLrhQWqG//7vwsjJ9ABD4BaJO4YGX3roWCBcHYA15nW/qG+obQ2ovWq0Bhgv7UDRGMMVZ9zvX2MDEeExlgkJmpfRAY7Qi1GRi0WiaHwBlGLkQH64pOj885ZljVThWVZs9Z2G0IbwhE2hDaEB6kz9dqooG89VG29gA1hpt4+RrYhLA1h8bcLhw4dTjsMy7Jmre02hDaEI2wIbQgPUmfqtVFB33qo2noBG8JMvX2MbENoQ+jQ4ZEahmVZs9Z2G0IbwhE2hDaEB6kz9dqooG89VG29gA1hpt4+RrYhtCF06PBIDcOyrFlruw2hDeEIG0IbwoPUmXptVNC3Hqq2XsCGMFNvHyPbENoQOnR4pIZhWdZsdcIJwpVXCg8+KIz+7zs64QrH0Jw4YnfmjDMig9QcE0VclWGWrxd4Nt7jaUW8JQxhnB8ZOKKffhIef1yI+FIRJxYXRAZ2ETey0reoE4P1uuMOAWcV8XAG1uuBBwS41hdfjEzERcLGyMD/33yzcPzxQsQTmcbjvaBsU9RNxUsZfIAbeyxGFJ4Wd+qiMa5v3bVLaPSB8mPmnHMiE/GdgEQWWS8SaBgV9EV6DcMA0Li2IvW88A8wotgCUvPaIdTU91tiGX//u4AdtYNn6v3is4Jl4IWiL84ZjduVZNp3msGaS0fEeesPA6g3iImwDCwSL7TeL2oxL94vPgzaeM6yrJmK36jWsSb9EwqZgfz/RkjZENoQ2hDaEC5Qe4B6XuTiSL6xBRvCDM4ZjduVZNp3msGabQgz2niu/NuFQ4cOpx3yG3W5JblrqaGWQ+XW4tSawIkN4fKe/3KNc+zIhtCG0IbQhnCB2gPU8yIXR/KNLdgQZnDOaNyuJNO+0wzWbEOY0cZ1qurQocNph/xGXW512f9YGzDUcqjcWpxaE5gZr3zsy/IKlmWQY0o2hDaENoQ2hAvUHqCeF7k4km9swYYwg3NG43YlmfadZrBmG8KMNq5TVYcOHU475Dfqsgqp/yhcfGFRbi1acIBgjNoDH/u+OqG2K0QV2ufaNjw2ZUNoQ2hDaEO4QO0B6nmRiyP5xhZsCDM4ZzRuV5Jp32kGa7YhzGjjOlV16NDhtEN+oy6rhpL74mGR5daitadkjNoDH5X0vpf9DuVASe9z1zg/5LC38BjXo48KzKfXCj//LMRWRS0QpZ4H95dG/EO5L3PLLZF5/XWhcYDQgwrc428UyePhxHALJW/s1HtTzzwzMqtWCVdcIeBw1q8XXn1ViPhYeT5z0kmRwe2mEe8rdyriAGGPG58m7+j88yMTcWvm3HMjE+uUeEqBxX0rQy9NXZd57rnIYBk4nKuuEvDLArj0zZsF+NKIHxTZ0YYNkWFei6wXGTPuToT3qHNxDIU8HvPWQ2FejIyhag+ATL1eRu1LsSMsEsvAUHVfNAZojHdUH059sPVpwLb9538K9Y4m+mxgvzjJ+qOCkbEMuHTsCMsA9ecKoLEe7JxlWTMVv8mXVUPJffGwyHJr0dpTMkbtgbevpn1YZDnUth9qeazJhtCG0IbQhnCB2ntgKMyLkTFUnbjbEBYHW5+GDWHxuQJorAc7V/7twqFDh9MO+U2+rCqcwJ596q3K4VC5tWjtKRmj9sDbV5MfIDRow7o9Oh6zsiG0IbQhtCFcoPYeGArzYmQMVSfuNoTFwdanYUNYfK4AGuvB1qmqQ4cOpx3ym3xZhYS+TfTbh0WWW4vWnpIxag+8fTXtAzT0EofKu+ehAY812RDaENoQ2hAuUHsPDIV5MTKGqhN3G8LiYOvTsCEsPlcAjfVg61TVoUOH0w75Tb7c6s3+F19YlFuL056S8ep9R12I2t7Gba+2vO2LXseybAhtCG0IbQgXqL0HhsK8GBlD1Ym7DWFxsPVp2BAWnyuAxnqwdarq0KHDaYf8Jl9ujTL7nN8j0c/laFmXW4vTnpJFaej828KuZS5v2+TnrnHR7FgXU/PtiqT1SNy3bIkM8romRf5KuUR5VoEl0HsmNTWPs5RThPvvF264QfjoIyHWKFsU2KdTQ4irlTeFkano0L643rO5ovM95S5FLNCzz0YGnueCC4TmR/K5DC4OxeWuF14YmbVrhThOieszq1dH5rjjBPjSiFcyfGX6YTjrLOGpp4TmtwO7FFkkTmPbtsjgNPjbAXwmNymnKcinkbnCXaAxsl5kzLATtVFBX6T19cgAi2wbZDARQGOsGbXz8wKGwqpQiw3irDARDFI9EfqiMYBfwn4xMmrb0TLY4ES1ADuql4Gzqk8DhhC1OBw0xjLwhVRucM6yrJkqLOuIlA1hhw2hDaENoQ1hYxgwMsAi2wYZTATQGGtGrQ1hATY4US3AjuplHCWGsPjbhUOHDqcdhmUdeVpJbjBsCG0IbQhtCPv6IhevRwZYZNsgg4kAGmPNqLUhLMAGJ6oF2FG9DBtChw4djgvDso4kdf8F6UqSDaENoQ2hDWHbF7l4PTLAItsGGUwE0BhrRq0NYQE2OFEtwI7qZdgQOnTocFwYlmXNWDaENoQ2hDaEbV/k4vXIAItsG2QwEUBjrBm1NoQF2OBEtQA7qpdhQ+jQocNxYViWNWtdnMEdld3FO/v/eKpZ/gcfCHGiQEO4XoHH06T/668jg1s34fHgTM44Qwj1eDt3Ct98I+zeLTSLhJ14KXPTTZGBm7r3XiHifuWezGefRea11wRcs/nKK0KcIzz9tICjwyuL+GsGb//BByNz0UUC7xGNbxS4ZTnYjz+ODO5cfeghoXHpcgfpySdHBle/RnyiXKlsVz7P4FcJL70kxGaFv++4KYPrapnmInNFLfJpXNIIR4RcHHYCE8ECobZO6wEmAvVE8MPYPoAHwDIwMpYBw/DHPwpoDO+B2vYEMuiLLWCRqIUjwr+52D5Whb44WMwLMDJWVW8fB1svAxPVLg4fQtTW28cWdM1zlmXNVPvSUcuyZikbQhtCG0IbQhtCG8IERsaq6u0fnYaw+NuFQ4cOpx3uS0cty5qlbAhtCG0IbQhtCG0IExgZq6q3b0Po0KHDCcN96ahlWbOUDaENoQ2hDaENoQ1hAiNjVfX2bQgdOnQ4YbgvHbUsa5ayIbQhtCG0IbQhtCFMYGSsqt6+DaFDhw4nDPelo5ZlzVBnKvFYBldW3nab0GS9v1FuUeQyzNtvj0zEDRkYwuuuE15/XWgmeljYGBlc4PnII0LE1wLuiowvM80W9GbUNWJEeb3nacIllwi7dglY86pVAi9oVY+3ebPAKzppce8VTg8h5E5OfDYinhT08k942g0bBPyiIeI2RdwyLv+MtSHEtQoM4Y3KywouHcUyLld0GfFx5tdfIxPxbYZvEHltbQnqtB59axsDY1aPjKS/XiQaz88LWFXtAbBm1MJOoBY7wprhLmqzgQ2i8VIOB9RuGaeBvpgIh1OfFZhoC+jbbipTbwHbRy2WgXnxutG43MKcZVkz1UI6WglXovOG9Clp4Q8hfRoqt6yjWWfaENoQ2hDaENoQ2hAmJtoC+rabytRbmJ0hLP524dChw2mHC+lopdYELskQ1o6uqx1qNlReaPRfWvUW1lW5BA+Wtaw604bQhtCG0IbQhtCGMDHRFtC33VSm3oINoUOHKzJcSEcrtSYwMy0NWa+h8kKt6yvC3uf2wbKWVWfaENoQ2hDaENoQ2hAmJtoC+rabytRbsCF06HBFhgvpaKXWBGYq9fouOC64tWy9stoGaNMVQl3V0CBZY8uHGljW0nSmDaENoQ2hDaENoQ1hYqItoG+7qUy9BRtChw5XZLiQjlYaGb8hKsE+jcJec9UWZpuH597C7hlqO+I5a2z5UAPLWpq2CvAtt94q0C+tCyHuU65RoO8yTz0VGawKt4wirf/228jAPmFHZ58tNIbwpsydd0bm4YeFiDsztKnqiHD5Z5wqfPqpAJd+7bVCxOsZ3ox6trJKic8yMN68NlY3uGZNZHBF5z/+EZnmrGRemOdbbolMxEOK+LRHH41MxAPK48ormXvuiQwcPj6TuL90+/bIILuG4414uuBpvfqV7gKZa+09QD0UsnzsAZk6GiP5xsioxcjI8ieaF7X1vDgNTFT7w3pVqMWOsKq33xbeeEOAAUYt+uKfFVyFitcN440tAGwf86IWHv73vxfqt4DDaVeSQV8sox6qnhfoC52zLGumijHaUzJGrZVqH7KGatvyoQZQ0b5TLkxNDmpoEMtaJm21IbQhtCG0IWwsEBoj6cfIqMXINoQ2hB3tSjLoi2XUQ9XzAn2hc+XfLhw6dDjtMMZoT8kYtVYKBmzIksF6teVd304HWx8QCnvbRN/g0NgGlrU0bbUhtCG0IbQhbCwQGiPpx8ioxcg2hDaEHe1KMuiLZdRD1fMCfaF1qurQocNphzFGe0rGqLVSvZ6qrR3ycu1DoT2N2GKfuvJDbmBZS9NWG0IbQhtCG8LGAqExkn6MjFqMbENoQ9jRriSDvlhGPVQ9L9AXWqeqDh06nHYYY7SnZLzgxHrNVVuYe+G5LczlWShsB2nD3uf2wbKWVVttCG0IbQhtCBsLhMZI+jEyajGyDaENYUe7kgz6Yhn1UPW8QF9onao6dOhw2mGM0Z6S8Sqc26iqt7arGmqANl1hrmXRwPjaZMyqukLLWj6dp8QvwgkhqCE888zI8K5IBV/W8GmnnirwFkp1nldfLTQJ9xeZ++6LTPczduAnTfb7ww+R2bFDgE3F9Z6YKM5X4ldFbmRF2hNxsSJ3ga5bF5nzzhOQuEb8U/kkc/31kWlu3bxEkXP+8cfI4NgjXszg1k1+ctS2nXxyZDDR2rXCCScIsNZXXilcfLGA2z7xmfzlFyHi6swrr0QG7+iUUyKD06BLr/NafDjQuExzx/gWNEYt5sVQ8AAwORgZoC/MBlwN+uJw4IhwODUTnTMaYwuwmhOtqt5Re3oZrLneEUbGK0Pjui+2j08OTgMT1SeJebFfNMZJ4oOEVZWHM2dZ1kwVlmXNWDaENoQ2hDaE79kQlueMxtiCDWHm6DSExd8uHDp0OO0wLMuasWwIbQhtCG0I37MhLM8ZjbEFG8KMDaFDhw4nDMOyrBnLhtCG0IbQhvA9G8LynNEYW7AhzNgQOnTocMIwLMuasWwIbQhtCG0I37MhLM8ZjbEFG8KMDaFDhw4nDMOyrFnrr5m7747M5ZcLd9whQP/8pwArwgR6k6I3Oka8o3yTgZ045xyBXjTezOBKUlwOCf/A2yDjo8xbb0Um4tYMfMtjjwm4zrRZ844M7nq9R6/K/OgjAR7+jDOEn38W4A/pHrGqLcLttwvHHSds2ybgWtGIFxQxokggcbAR25TdyrfKDcrzynvC+hDiEQXXme7K4KVEbFfuyGzaFBmmqgBZLzLmOhev83iAeTHUJOk1azERhsIiMW9tRAE+OlgVaufmhHoLWDMaAzgTvMF6R5gIfQEWiZPERPWqYL3QGEPVp4FV4YX+4Q8CrjZGX4yMNWMZ+FUCGuOcdaI5y7JmqrAsa9ayIbQhtCG0IWSKzKEwERrXlgATYSgbwuJw0BdgkTaESzCExd8uHDp0OO0wLMuatWwIbQhtCG0ImSJzKEyExrUlwEQYyoawOBz0BVikDaENoUOHR2cYlmXNWjaENoQ2hDaETJE5FCZC49oSYCIMZUNYHA76AizShtCG0KHDozMMy7JmLRtCG0IbQhtCpsgcChOhcW0JMBGGsiEsDgd9ARZpQ2hD6NDh0RmGZVmz1cMPCzBmH38cGd6deLoSt2dOPDEyuN6zSaAfVq5ULlYkF28Sd63dGMJaJT5QZF7kSBFPZV54ITK4hfLmmyMTm5VVylbhu++EiGuVOzO7dkUGQ9F5nhiZCy8Uvv5awCKb/V6kYJEvZdasiQzuEY0NSjyeuffeyDQeT35ZgFU98URk8PHeuDEyEXcpsoXNmyMT8XkGd73i1wH4vQMvHUWqirQeIAmus3z0xUTItpG4IzXHvPjZqPN4LKMeGWBVbYMM5oWNQW19GqjFUHXfer8AjTEUQF+8BawKjetauGV8rvAWMC+2AGoziU8s9vv3vwuoxcj1mttPS2LOsqyZKmrtKZmd9l1W36Ohcss6cmVDaENoQ2hDuAASaBgGzIufDTTGyFhGPTKYJK3nvDAMqK1PA7UYqu5b7xegMYYC6Iu3gFWhcV274g1h8bcLhw4dTjuMWq0JnMQQHoI9q7t0tUPNhsoLjXLj3sK6KpfgwbImkA2hDaENoQ3hAkigYRgwL3420BgjYxn1yGCStJ7zwjCgtj4N1GKoum+9X4DGGAqgL94CVoXGda0N4XCq6tChw2mHUWtk/IaYnYas11B5oVFujJKhsPe5fbCsCWRDaENoQ2hDuAASaBgGzIufDTTGyFhGPTKYJK3nvDAMqK1PA7UYqu5b7xegMYYC6Iu3gFWhcV1rQzicqjp06HDaYdTqvF8v4wSn1CWiqEWbXJLb59quaqgB2nSFUFc1NEjW2PKhBpZVyYbQhtCG0IZwASTQMAyYFz8baIyRsYx6ZDBJWs95YRhQW58GajFU3bfeL0BjDAXQF28Bq0LjutaGcDhVdejQ4bTDqLWnZJyyU+qeu/Jc0ha27fEw9Nxb2D1DbUc8Z40tH2pgWZV++km4W28ZjfheOCME5uJXKDAM6kzqvmtCWK1sUrbCAolfgqelP4wbMw88EBlcwgn71Ax1T2bDhshAv/mNEPF15ocfIvPjj0LEZ4rYp08/jQyc2OmnC/fdJ1x3nQBD+OuvwqpVQsT7yrbMCSdEhveXqhO78cYowI5wIyuuft25U4BrfeqpyPCGUnzq9AP80kuRefJJ4ZJLBNyai75tejoByPJRWyfQSNyRmiPpBxgZfbEM9K3dRZ3H1/6hnhfuAo1hkACGQu1EQwG8QWwQtXhlGAqOCIeDxvVEaIztA/TFaeCFYmQYUawKQ6EW4OONecvP1ZxlWTNVlx31a0/JOA05pba8eMgaqm3LhxpARftOuTA1OaihQSxrUbIhtCG0IbQhtCGkUakdEWonGgrgDWKDqLUhLFiaISz+duHQocNph1121K89JeM05JTa8vZh9DxkyRYzIHSw9QGhsLdN9A0OjW1gWZVsCG0IbQhtCG0IaVRqR4TaiYYCeIPYIGptCAtsCB06PGrDLjvq156ScRpySm15+5DV1i5+wEJ7GrHFPnXlh9zAsirZENoQ2hDaENoQ0qjUjgi1Ew0F8AaxQdTaEBbYEDp0eNSGXXbUrz0l4zTklHIIJ9bbpS3MvfDcFubyLBS2g7Rh73P7YFkTyIbQhtCG0IbQhpBGpXZEqJ1oKIA3iA2i1oawwIbQocOjNuyyo37tKRmnIacEW9Xrsrqq3tquaqgB2nSFuZZFA+NrkzGr6gota/G6QxE3hasUH300MriGMc4MgRd4Pq28lrnggsjAa91yiwCjAicW6yOzZYtAfxhfKpdncFFqnCt8/71A/7BBaG5z3ZXBUNu3C7jN9YsvBOwI+VVsETZtEiLezBx3XGRgF59+WkBtxOsZ+FK+o3hO2Z25//7I7N5dcfvtQlygxG8z+DBE3KZcrOBXGLLIiJ2KWPrnn49MrFPwu5I6j0dOjOQbIEWGf8BQoO6LDxbAUG+/LWBkgO1jqPo0MBSSfhxOPRGGqmsnckTYQr0qUDeu91vvaKIN1jsqvdaYVdWHUy8DDnAix6vzzlmWNVON8lHLsmYoG0IbQhtCG8LGEtgQFrU2hJljwhAWf7tw6NDhtMNRPmpZ1gxlQ2hDaENoQ9hYAhvCotaGMGND6NChw6WFo3zUsqwZyobQhtCG0IawsQQ2hEWtDWHGhtChQ4dLC0f5qGVZM5QNoQ2hDaENYWMJbAiLWhvCjA2hQ4cOlxaO8lHLsmamU08VIn5WdmQ+/DAyEc8Iey1TJp7N3HRTZGDqrrhCiLgkg4slv/tOiLgmA6Ny0UXCSScJ114rRNwrnB8ZDHXmmULEW8qHGcx71lkCLBAcYHMn54+ZVbztUyzQGWdEBp6W+6U9fiyzY0dkYL3g0/COeFHqKYqu6rTTBPzuIOJ5RT4qETcIusi1a4WIqzJ33BGZiEeUg6e6F/46ID5SxB7zXtx4VEBOjCQYeS0sARoDmDpkzADZ9gcfCHWWj3lrh4B5sX2sGX3bPWawKvSdaCg0xiJRi/22Z5upj+6PfxTQF4dTnxUmwlD4XKEWQwGcBj6T8Gn10dWvDKvCyGiMZaBvOdGcZVkzVViWNVvZENoQ2hDaEC6A9NqGMFO7GhvCo98QFn+7cOjQ4bTDsCxrtrIhtCG0IbQhXADptQ1hpnY1NoQ2hA4dOlxCGJZlzVY2hDaENoQ2hAsgvbYhzNSuxobQhtChQ4dLCMOyrNnKhtCG0IbQhnABpNc2hJna1dgQ2hA6dOhwCWFYljVr6S2jW0OIm4W9OXQCDmHnTmHjRuGpp4SIazN7VM1tkA9n3nwzMrSpajUj/pq5557IRFyfefXVyES8l7nxxsg0BvjWzOrVkYm4UdjrcxK//irs2iU03kNeGbxlxEPKNuUV5ZsMXCst7mq5RnXzZiHiU+H4ENR61YaQZ7VOrujEbwciXhD2RObllwWYyXvvjUzEA8rHGVyyCpe+dasA0x7xRYYuHZkrQD49Nyeg8euvCzAbyIkBJqprYSdQWxuVGqwZHgD7xUQwZvUia9eKi1KxKsyLiUD9QjEUatEXI9fLmOjt1yPjUtn6s4G+9faxSEyEVdUfFYwMyqHmLMuaqaLUnj0VlmUti2wID2JDaENoQ7ifuhbpNWphCZDH12DNNoQZjFwvY6K3X4+8Agxh8bcLhw4dTjuMUq0JPEIM4Shl7S2sq3IJHixrVrIhPIgNoQ2hDeF+6lqk16iFJUAeX4M12xBmMHK9jInefj2yDaFDhw6nGUap1gQesYawCHuf2wfLmpVsCA9iQ2hDaEO4n7oW6TVqYQmQx9dgzTaEGYxcL2Oit1+PbEPo0KHDaYZRqjWBmbEaea0uw0RVWz56bsuhrqrt22ps+VADyzpssiE8iA2hDaEN4X7qWqTXqIUlQB5fgzXbEGYwcr2Mid5+PbINoUOHDqcZRik4QDBWo8Qyh2350PMo7J6zcvu2EBpbPtTAsg6TTj5ZiLhdETcV8UTmm28i01wOCSvyWubZZyMT8ZJwXgi4lTE+UNTTxm2ZTz6JzIsvCvAAJ5wQmdigxOPKc4p4gF9+icxPPwm//a2wbp0QcWkG96bCLsbZit4UumlTZGC9PvtMoBPbGBm83+uvFyKuy+DaWDheuKmrrxbgtLHfyy4TYo0S72e++ioK7r5bgAF++OHI4P5SOK8LLxTgPM89NzKPPy4wY66zbeS1oLYxaNwmzcVEWBV8GjJ1DAWHgKHgAWr/UK8KfeuhsCrU4ujqDcKl1+c8Py+gFjtCYywDtXj72CAu4cS8OCssA43feEPAWWEinAY+OZiopr5HFPvFqlCrZzVnWdZMFaWy/WsZK3itIQ82thwq2nfKhanJQQ0NYlmHWzaENoQ2hDaEPaAxVmVDmLEhzBydhrD424VDhw6nHUapbP9axqo1bIdc3tm8oTbQ0JidxjawrMMkG0IbQhtCG8Ie0BirsiHM2BBmbAgdOnQ4YRilOu/Xy1gNmbdJy1EIscU+deWH3MCyDpNsCG0IbQhtCHtAY6zKhjBjQ5ixIXTo0OGEYZSCAwRjBa+VPdjQ8+ihN+wtXEzf3uf2wbJmIxtCG0IbQhvCHtAYq7IhzNgQZmwIHTp0OGEYpUbGb4ixqk1ap94Gbdhbkgt7x0RVLsGDZc1Gn38u8P7D1QIS6G+/FbZtE847T7jpJiHiI+VrYX1kXntNwE2hyLYj/qHcpexQPsvAIME/4E5OGKRrrxUapw1rfUUGfc8/X0DaE/GdoOYqtgp4vxHvKG9nkDKt5kWp7yk7M7j69bbbBC5Sb938xz8ic/vtQsQtwt5/MzP6UeEvC/Z6swSs9dlnCxGfZPCpO/10oXm/r2Y+/TQyEY9luq+E/V8M+C0F0vo//lFALaxInSL//vfC//pfAhrDA8C2wZn8/e8C+iKPrx0gNjjRqjARXuFbbwm4ZRQniaEwL6gNEhb5yisCVoV54YhwGmgM64Xaui9q8RYwMsCHAduvP5MYCo2xfYyMWrwUuGW8BZ13zrKsmSosy5qtbAhtCG0IbQhtCHmSGArzAhvCo98QFn+7cOjQ4bTDsCxrtrIhtCG0IbQhtCHkSWIozAtsCG0IHTp0uIQwLMuarWwIbQhtCG0IbQh5khgK8wIbQhtChw4dLiEMy7JmKxtCG0IbQhtCG0KeJIbCvMCG0IbQoUOHSwjDsqxZS1Jz5LW4LDHioszatZGJzYqayVgj4JLGE08Umjsbr8ogF4d/uPlmgfYpHs4wNY8flHuU75VfM/feG5nGeskNlvC0EU9lrrkmMnGKwGPnBlX0S2q89dLRiIcyzTWbu5VrMjBXGzcKzZWkjwvweHqZLY6Ov0o4MwS1XvDwEfcpmOjTzM6dkYEhjLhVuVe5LtNYXF1VnV6XiSyT4DrbhgdAxtwl1r1g5D/8QUBjeC1MVK8KluDf/k2AUYHFxcg4OgCnjV9ptCeQwUQ4DbwUbBDmGfuFt4RdxETY/nPPCbC49W8WanB0qK0nqp02Phv4mKEv3hEOB7VYJF6KHvucZVkz1cGkxbKsGcmG0IbQhtCG0IbQhnAYHB1q64lQW38IZ2cIi79dOHTocNrhwaTFsqwZyYbQhtCG0IbQhtCGcBgcHWrriVBbfwhtCB06XJHhwaTFsqwZyYbQhtCG0IbQhtCGcBgcHWrriVBbfwhtCB06XJHhwaTFsqwZyYbQhtCG0IbQhtCGcBgcHWrriVBbfwhtCB06XJHhwaTFsqyZCF/0TzwhRLyf2b49MmvWCL/9rUD/QGeit0HGz5mTTooM3GPElwo8reTiEfdncKFlbBHuvFNoJhKdeqqA04h4IfPMM5FBbRwfmcbTio3BVaiNeYalF9v24IORiY1KvKL8M9M43ksySLf46wB1rTt2RKbR9gzMJNI8mKtzzolM45YvVX5UrlXEHvPeVP2YPfRQZOJkAbeb4rcSY+5ORC2sCEC2jRT5//5fAVbk/fcFjAyzAdeKxhi5dlMAjeu+2G8N3AU+SbXnadeZqYfCMuB58JNT18IQwk3Bh+PoMHLtpuDDcXQADhATYZE4DZwkPldojJ8FnDP61tvXkecsy5qpDn7/H52a3yeWTqihEbryoQadlmUZ1goVvlJtCG0IbQhtCG0IWduuM1MPhWXAmdgQZmZnCIu/XTh06HDa4cHv/wHNN2IL1dgGy6uJphtqPLZ8qEHWYtpYVo/wlWpDaENoQ2hDaEPI2nadmXooLAPOxIYwY0Po0OGKDA9+/w9ofu+/HpNo0vZL1LJMNzRIVz7UIGsxbSyrR/hKtSG0IbQhtCG0IWRtu85MPRSWAWdiQ5ixIXTocEWGB7//BzS/91+PPo3K5w+oK2xLuvKhNijsynODNmxL0gAL5fm5a5Cfs+ryoQZdYVeFEssaL3yl2hDaENoQ2hDaELK2XWemHgrLgDOxIczYEDp0uCLDg9//A5rf+69Hn+b3KYd46EI0yy3r566kK89hW5LD3uf8MOlzb2H33JXk0LIWqW0Z3BUZJyo0SDcIe91IZpOid3Lixs7jjosMbt1sMnV1U/F5ZsuWyGCiRx6JTMQdmV9/jcxllwmbNwuxQYmdmW+/jQxqI27MNF7rrgzNxirh7rsFbAE3lOISzlNOiQzeL1Z1xhlCs6NnM831rdJ4167IRFyZef75yMCn4HAw8uefRyZih3KTsBF+WIbCLxqQi/7wg/DLLwLuTcWdq/zVCexE7Vtee02Ax0MCXYN8Gqk5rAj6wvJhkUi+wbuaqcOZAPTFD8Nddwm4dRO/Saq3j89ZbTZwVhi59nhovPebO/Pv/y78678KL74o/J//I2DN+CBhGVgkdoTTqJ0YhsJZ1b8dwMgYCmdVvwVsELXlR3TOsqyZKsZpZHuyunI0q8vrcGw5Gow01GvouX2YtHyoQW9oWYuUDaENoQ2hDaENoQ1hYuUZwuJvFw4dOpx2GOM0ZHKGvNBQeR2OLUeDkYZ6DT23D5OWzzfa31SbWdZEsiG0IbQhtCG0IbQhTNgQOnTo8DCGMU5DJmfICw2V1+FQefeMBiON7YXn9mHScjSA6lrLGpINoQ2hDaENoQ2hDWHChtChQ4eHMYxxGjI5KB+yTG2YW459bkMILevn/DDpc1uYy/FsWRPJhtCG0IbQhtCG0IYwYUPo0KHDwxjGOI0sUFZXjmbdQ9FsVII2KMzlXS1KOuWqsc8ozKrLhxp0haPyHFrWYgU7sXu3sDdXzSCPR9+Iq5VPM/fcE5mnnxZwsSTSvIhvlTuVxzO4KbTxPN9kkF3HZgHL2LlTgD78UIh4UHkrg9OIU4WffhJgkD79VMAiG8crPhzJdsTLGeRmmzYJsVY5X6GHl2tjm1XdkoHVxG8lvv5aiPgh0/wq4aCF20tjyy/NwJidf75w2mnCrbcKEbsy+FnARwWGMOI2ARc8AnxG6ywfCTRyYuTxqH1XM3WMjFqk13u/gTIYGavCyFhVnfRjKPTFqkoPwJNEY4yMvgCLRC2ODuBnEveIYr9YJI4dOwIY6o03BCzjlVeEl18Wfvc7ASYWE2EZr74qYL8AfbF9/KRgR7j7FI31/c5ZljVTLWRRR4BqN1XUzu8TSw+7jpBlWEelbAhtCG0IbQgXgFGpXU3tTDAyVoWRsSobQhvCWRjC4m8XDh06nHa4kEUdASrcVFFlWceCbAhtCG0IbQgXgFGpXU3tTDAyVoWRsSobQhtCG0KHDldYuJBFHQHqdX3z+8RSyzrGZENoQ2hDaEO4AIxK7WpqZ4KRsSqMjFXZENoQ2hA6dLjCwoUsyrKsGcqG0IbQhtCGcAEYldrV1M4EI2NVGBmrsiG0IbQhdOhwhYULWZRlWTPU1q1CxNOKGMKnnopMxOvKd8ozGWTbES9mjj8+MhFXKX9RIHEIjz8emYiLBHU155wjhHL//cJttwnNaYhr/fHHyJx8soA1P/dcZK65RrjySqG5RvUXYe/gGXXLMN7NK7tcuUJ5UpHPBsxkxHuK3COKt9D0/TyDc4a3PP10AZfKXn99ZM47T0DfCy4QMNG6dULER5krrohMxAOC7pe/WUAu/m//JiDpr3NiNAYwKqhFAo0bOzERgGvFxZJwCLV9ggdod1HsCOCssEE0Rm09EXb0rno81GIoWE2AZeCz0bbP4AcJa66PHbVYM3aEd1RfWIpFYl4Mhe3jDWIZAFewora8F3fOsqyZKizLmq1sCG0IbQhtCBdALm5DWEyEHb1rQ3jUG8LibxcOHTqcdhjjNH9Afp75s3VsyobQhtCG0IZwAeTiNoTFRNjRuzaENoQOHTo89DAsy5qtbAhtCG0IbQgXQC5uQ1hMhB29a0NoQ+jQocNDD8OyrNnKhtCG0IbQhnAB5OI2hMVE2NG7NoQ2hA4dOjz0MCzLmrW+EM4OIV5SdinbM6tXR+bZZ4XYoMRXyrMZWKDbbxdWrRKQuOMeUdwyiqFgCG+8UfjlFyHi48yFF0Ym4jnlOuVRRQwhsr6IGzK79HJX3FB61lnChg1CHKfEJ5nLLosMfAsd75kC3kIoF18sxOnKeiW+FPAhPEuJe5VtGSSfuM4U/hCvm9b6vBBonkUYGfeIwj3FJgWZK67ZhNlAtl3n00i+/+VfhL/9TcDI6Itl1Ik7HAKAbwGYCM4EE+FSStTicDAUjh2NMRRusMSO8Moee0zAyOiLjyzeAv5pADgrvDJYIHwKP/hAQGN8NnBWeGXYAvrW7xfz4iSxIywDZ4VloDHQieYsy5qp8JVK/Zf/UnEYtWefWHpU6RjYgjUl2RDaENoQ2hDaENoQrmhDWPztwqFDh9MO8ZVKtSZwQkM4ckG1F1pkGxYttzBFFw6VH4KW0tc6hmVDaENoQ2hDaENoQ2hD2J+qOnTocNohvlKp1gRObgjxAOXywhMOlS+jhqYYKj8ELeNQ1rEkG0IbQhtCG0IbQhtCG8L+VNWhQ4fTDvGVSrUmcBJDeAh/W+tt0ztOdo+j51yCwlyOqqKkKB/q1TVoy3OtZWV9YUNoQ2hDaEPIkdEXy7AhzOCV2RDaEDp06HCSEF+pVGsCjwxDmEtyuMTn0QPConzs8yjsntvQsuLVV4WI3wqa5X/2mQDfwqwXWX68lcFFmq+8Irz/vgDnGZsjQ2cSbyqyyFgXQnYpezlBwV2RvPv0jszu3ZH5xz+EM84QAtSuRhdJA7xaOPtsAdYLuSiuUcUVnbExMo0BfkYR6xXxWeaJJyLzxRcCtgDjHfGrIp8rutZzFfV4330XGX5ET4kMfiuBe0RxznDpqOU5r1FgNpAT49MAo4L0GuB9w8XVST8m+t3vBGTqmAg/z0j6sQz4JYy817ll6kWib+0Q8G8f3gJGxgZRWy8S4B9KXNCKNWNHOCv4w3pVtYfHFZ14ZXj7uMr5f/9vAWtuTyCDg8WHH8sA9VBojFr9jpmzLGumilqtCZymIRxqUI8zFB5p5b2hZTEpsiG0IbQhtCFcABPZEGZQWy8S2BBmcLCzM4TF3y4cOnQ47TBqtSZwaoawqK3H2dNoqFn3AKEBwuUq7w0ti0mRDaENoQ2hDeECmMiGMIPaepHAhjCDg7UhdOhwRYZRqzWB0zGERVU0tXXYaajZEtsfcnlvaFlMimwIbQhtCG0IF8BENoQZ1NaLBDaEGRysDaFDhysyjFqtCZzEEMaATToEj1R3763N5UPPoxAPiy8feh49tCGqLGtBNoQ2hDaENoQ2hHwLGBkbRG29SGBDmMHB2hA6dLgiw6jVmsDJDWGnXNjbYKSuKiuXt216u+fCXI6qtrAL6/JchcLuGSGqLGukJ5WnM7iiM+J5RfTRR8L27ULETuUeQT3eHXcIjeW7NIPEBlYkYrdwpt6WqVeSnndeZCKuVR7MPPNMZG6+WYg1CvVC5rbbIvPVV8JPPwnY4Nq1kcFNobwbE7UnCj//XBHnK5sUPRx6rXgsgx01/v83irzujRsjw8+Gvt8ffxQi7svs3BmZiA8yONj8D+6+f0wvErZG5sknhfXrhYi/CEhV31VTV+e1yInRGBc84lbGGkyETB2NsQxYArxgDIWJsAWMjHkxFMBQuFcTjTER7BP6ojF46SWhtotwgACNsX00rj0tzCQ+Zu3UGcyLoVCLt9++lww+G/V+Me/vfy/gleE0sCodec6yrJlqf2Z0xOtAAjCBJm0/bR3CFqwVIhtCG0IbQhvCBkyEPB6NsQwbQhvCo80QFn+7cOjQ4bTD/ZnRsSi7L+tokQ2hDaENoQ1hAyZCHo/GWIYNoQ2hDaFDhw4XHe7PjI5F2RBaR4tsCG0IbQhtCBswEfJ4NMYybAhtCG0IHTp0uOhwf2ZkWdbsZENoQ2hDaEPYgImQx6MxlmFDaENoQ+jQocNFh/szI8uyZiXcu/jQQwKuyrzvPiHi88xxx0Um4krlVuXFzPHHRwZ+6ZtvIhPxdmbXrsjATmzbFpnmHlHVKuUUZaui/gFeC3ax8dJ3KXdmTjopMnGWEj9mGqPyq3B2CJz3LUWO7tRTI3PWWcLllwuwfBEPZXgDLd0yLob9p/JtZuvWyOAtXHttZCJ+yLz+emRwjWrj/y8XzonM998LJ54o8C2E/lZCfThTVbg41CKPr1NzJN/oWzdGag53gVpcd4laOCKAvnBxSOvrVWGo1n5ksH3cuYra0k7QPmGRGBlDoTG2D7cMMBQOFo27995L/anDfnGSmAg7wuHUI9dDoRYjYyj0xb9BOtScZVkzVViWNVvZEIpsCG0IbQhHIJ+2ISxsDJwJFmlDmKlHrodCLUbGUOg7zhAWf7tw6NDhtMOwLGu2siEU2RDaENoQjkA+bUNY2Bg4EyzShjBTj1wPhVqMjKHQ14bQocMjOAzLsmYrG0KRDaENoQ3hCOTTNoSFjYEzwSJtCDP1yPVQqMXIGAp9bQgdOjyCw7Asa7ayIRTZENoQ2hCOQD5tQ1jYGDgTLNKGMFOPXA+FWoyModDXhtChwyM4DMuyZqtXXxUirhFOD2GPoqbutdci09wz+VGG3nK9osIlnLh2Ek4MZvKMMyJz4YVCHKeoJfjkk8jwNNRsxIbI4IJW3DOJK0k//1zAjho/vGC/E3oavM1VHCB8y+mnCxGvC1vFAKPvK68Ijal7T5GDvemmyPCCVn0prMX9tPFXZYciH1Eczq23Ribip0zj8S4S1qinXS28/LLAn7ILFOS1yNTr5LvOp9EXZgO1WAZsTGshMki+J9oCqB0RVlX3rRvDTOIksWbUYqKJ3BSWATAvTrJ+KZh3fl6oawF+0YD7PPFRATicbnkjcBpYFU4DQ2GRqK37YpG6qjnLsmaqhVSv0N13VxxGHfjN+1I1dpDlmsiyFiumqjaENoQ2hDaE79gQ6ppRi4lsCDM4nG55I3AaWBVOA0Nhkait+2KRuqq58m8XDh06nHa4kOoVak3ghIaw+6+ohlxWbjDUJhZh5BapxYyzmDaWtWxiqmpDaENoQ2hD+I4Noa4ZtZjIhjCDw+mWNwKngVXhNDAUFonaui8WqauqU1WHDh1OO1xI9Qq1JnByQ4gHaKgcWmSzsVrMOItpY1nLJqaqNoQ2hDaENoTv2BDqmlGLiWwIMzicbnkjcBpYFU4DQ2GRqK37YpG6qjpVdejQ4bTDhVSvUGsCJzGEcFa9Rqu3EGrb7Ptr4oJ6C4vyXNVb2FWhxLKmJaaqNoQ2hDaENoTv2BDqmlGLiWwIMzicbnkjcBpYFU4DQ2GRqK37YpG6qjpVdejQ4bTDhVSvUGsCp2AIC2M2UjtOV5IfluW5K8mhZU1V9yvi4nhV5vHKmcLGjQLu87z6aiHim8zHH0cm4vHMiy9GBs5zxw7h/vuFl14SeN9jPKeIa6XJ2YhLKd9XnlTuVL4SdKgvvxTuuEN4/nkBdhGXf+7eLVx8sYBbGJ94Qmj+jZXtI93C24+4LnPFFZGBSz/77Mhcd53Ag1X7hJtCccfszp3C448LEd9n8LlqbqB9IIOJcGchDD9Hjm2KjMycGIksgCVA3zr5Rk6MWrgaDAWjgqHqXBygb53l1wYJtfCl9Y5gCDEUVoWzwkT4NKAW76geCodTbx/HjpExLxpjKIChAA4WI2MLGBmrwucZfdsPz+LBmnGS2njOsqyZapSPDqo1gcttCLNaY9aVF2FvYTZ7E5X3hpY1VdkQ2hDaENoQNlk+hkI+jaHw4WiXnUFfG8IMDqfePo4dI2NeNMZQAEOBY9EQFn+7cOjQ4bTDUT46qNYETtMQxkCbxYwz1KYoh3qbWdZhkA2hDaENoQ1hk+VjKOTTGAofjnbZGfS1IczgcOrt49gxMuZFYwwFMBSwIXTo0OGyhqN8dFCtCTyGDGEuh+pay1pe2RDaENoQ2hA2WT6GQj6NofDhaJedQV8bwgwOp94+jh0jY140xlAAQwEbQocOHS5rOMpHB9WawEkMYQwYsOJ5yIkNNcsPh/w8CnufLeswyIbQhtCG0IawyfIxFPJpDIUPR7vsDPraEGZwOPX2cewYGfOiMYYCGArYEDp06HBZw1E+OqjWBE5uCDvlwtSkvw001KW3sCjPVb2Fo/IcWta09amgZqO5hPPXzNatkYn4ThGHECdGhu5xqxKPZM49NzIRN2UefTQyuODxgQeEWC3gstOvvhJgn2D5mjsqDxqefXyROf74yODCUvzjhptRY7MAZ3LSSQI8D6zmqacKsJovvCDwOtNzIoMcODYp8YzyG0V+7xDrIvPddxU4yWefFZorSW/LvP9+ZLZsEfjbgVMjc801An5S8KnDbyVwdLywFDkxPnbIa9vcPQN3UefxaIyMGX2RbaMxhprIqMB6waehMWrxyyEcHW53rdfcHmYGywDYL8DRoRYvBdd7Ys3wSwAjoy+WAfAhRF+Ao/v73wUsAyeJ/bZHnamHwjIwcn0aWjtnWdZMFUeJWts2JR22iSyrkw2hDaENoQ2hDWFzmBksA2C/AEeHWrwUG8JMPRSWgZHr09DaufJvFw4dOpx2GJZlzVo2hDaENoQ2hDaEzWFmsAyA/QIcHWrxUmwIM/VQWAZGrk9Da+tU1aFDh9MOw7KsWcuG0IbQhtCG0IawOcwMlgGwX4CjQy1eig1hph4Ky8DI9WlobZ2qOnTocNphWJY1a9kQ2hDaENoQ2hA2h5nBMgD2C3B0qMVLsSHM1ENhGRi5Pg2trVNVhw4dTjsMy7JmK6S5t90m/PijEHGZoEYlThM+/FD47W8F3H4ZcXnms88is2aNAEN4+umRefJJAavatEnAVZlY86pVwoknCjfcIODmTJxkxLcZJK7NnZxyzr/8EpmIrzPXXhuZiBuVizPbt0cGO9qwQWguaBWL++mnkYHhj3hWwEcl/pT54ovIXH+9gHNu9qtW88LIdDd37f/fZ6/W3wjgtyF7P1qZuFWR+3i//joyJ58sxHolHlLk0840F4ksQNYLr1VmvWyMWqTXMBvwDxgKfbGj2k6gMTaIvrWNqTeIiWDqMHLduK7FUNgC+mILWHPdF43reXGw9X7xjj74QJhoVTVYRtsgg3nRt6bsO2dZ1ky1kI9aljVD2RDaENoQ2hAuAA9gQ1g0rmsxFLaAvjaEmbZBBvOib03Zd67824VDhw6nHS7ko5ZlzVA2hDaENoQ2hAvAA9gQFo3rWgyFLaCvDWGmbZDBvOhbU/atU1WHDh1OO1zIRy3LmqFsCG0IbQhtCBeAB7AhLBrXtRgKW0BfG8JM2yCDedG3puxbp6oOHTqcdriQj1qWNUPZENoQ2hDaEC4AD2BDWDSuazEUtoC+NoSZtkEG86JvTdm3TlUdOnQ47XAhH7Usa4Y67zwBNytGPJC54ILIRLyTwY2dcZKiSTAbbxTgxJjWx2OZn3+ODK5/bNyUGLMbb4zMjh3CpZcKWPP33wto/M03QsT7BWedFRm41m3bBBgzWD7cyYmDbRz+zxkce8TDyouZX3+NDCaK+FA4KwQVLF8cr3BkdYBxi6LzxrYM7qRsTOyDivzegfuNOzMnnBAZ+FLcTxvxmYBMHbn4RAYJqXmbFmcwFOYFuP1yfl7A5Z+4grb2AFjGRB4AjbHmeiLU1qAv3HK9ZrxBOECYSQyFF4qR63nbl5ipG+OFYiJsoT4NbAGmfaJaUE9Uo33nLMuaqTQpaISrjMFh1IEsdNm0lNG6vsu+KmslyobQhtCG0IawxxIAG8JMbYHQ2IYwU1u+uhbUE9Vo37nybxcOHTqcdqhJQaPWBE5oCDWH7Nci27BoaVrKgLnvUsaxrAXZENoQ2hDaEPZYAmBDmKktEBrbEGZqy1fXgnqiGu1bp6oOHTqcdqhJQaPWBE5uCPEAoXyRzZaupQyY+y5lHMtakA2hDaENoQ1hjyUANoSZ2gKhsQ1hprZ8dS2oJ6rRvnWq6tChw2mHmhQ0ak3gJIYQZqnXOx1am6yhqt7yXDL03DZGeVuVQ8uaTDaENoQ2hDaEPZYA2BBmaguExjaEmdry1bWgnqhG+9apqkOHDqcdalLQqDWBR4wh7H0+2CiFvW3ah9HzUK/e564kh5Y1mbZsESjktWcrmrjjrsiIe4UNkcF9nnBxES9naBj0Is1HHokMPC3MVcSuzHHHRQZ36WEZxx8fmRdfFCKuzCCfRN+bbhJQi0spcTUoLoZtjk7uID3ttMhAMKK4ORNE/JR54IHIxDpF39Gjj0YGa77kEgG1dGKnKHGpIr/C+Oc/I4PPJPx/xNOKOM8nnohMxF+UF4TTQzhBiacEJMFIc2uQiyPLb/PgDIwKlgGjgsYT+Qf8MGCievtYBjaIWmywNnWoxVB7XW4GjVGLNdcnWS8SJ1kfDobCS4Ftw79uuOkYy8BEePuoxcGiFh9R7AgjYyjsaKJ5sSO8Be07Z1nWTJUSkz61JnC5DWEcsFit0epUjzO2V2+DUWE91NAIdWhZk8mG0IbQhtCGcAEsAwk0GtsQZrDm+iTrRdoQZg6jISz+duHQocNphykx6VNrApfbEC69TQ73qNoGnXIDFGZ15WhWhJY1mWwIbQhtCG0IF8AykECjsQ1hBmuuT7JepA1hxobQocOVEabEpE+tCTyCDeEiy3PhUBeobjbUy7IWJRtCG0IbQhvCBbAMJNBobEOYwZrrk6wXaUOYsSF06HBlhCkx6VNrAicxhDHgyoae27ATuuRhh6ao27QPo2eEbflQG8s6RNkQ2hDaENoQLoBlIIFGYxvCDNZcn2S9SBvCjA2hQ4crI0yJSZ9aEzi5IeyUC1OT/jYQug91yYW5qm1cPLeNUZ6r0MyyJha+NBst3CfZgTs5kSJv2CDEcUpcm1m9OjKNq5F5Iy7LvPBCZF55RYj4IAMzCSeGpChih5Ky9niKd1SuUtYrer8lD0c3eOWVkYn4UYC7wL2a50SGdpH26f3M3XdHJuLXTON4b83wXk1d5EcfCXgpEY8KZ8kdpPzNwhkC/jWEa331VQEfFZj2H36IDEaOuEN5WPlrBsk23XLcoMhvJZgx11l+nbijFhkzQGNk6nVtbXIAFlnXYmQAJ4bD+eMfBfx4Y6L6YHFWWHO9fQyFidC43j6GwvaxyHpH9bx4v2+8IeAkcc71S0FfTIRVoS/utsVPChpjGZgIjfWc5yzLmqniKNGB9GD/s1bOTHlVlnWIQs7QSHyLDaENoQ2hDeECtSMCWGRdi5EBkn4cjg1hsaN6XrzflWcIi79dOHTocNphHIXalydY1rEi5AyNxLfYENoQ2hDaEC5QOyKARda1GBkg6cfh2BAWO6rnxfu1IXTo0OFhDOMo1L48wbKOFSFnaCS+xYbQhtCG0IZwgdoRASyyrsXIAEk/DseGsNhRPS/erw2hQ4cOD2MYlmXNVsgZGolvsSG0IbQhtCFcoHZEAIusazEyQNKPw7EhLHZUz4v3a0Po0KHDwxiGZVkz1tnCt98KEW8q32cuuCAyV1whvPmm0GTbz2V2744MrMjVVwvwabiFEhN99VVkcG/qs88KcCZ33ilEvJah9TpdgFuO+Fl5JHP55ZHBlZXYUcQlmbvuikzT+C3l7Qwa//a3kUEtruhELd7Rc88JuIOULyV2KpcqYlNjcwhxX+appyIDPwwTe/PNQmPL7xL2HkBGhewa18Z++qlw1VUCU1VkveD11wUkwbATyKfxM4l5kbhjZNTiMkxMhJHrDWIimBzM245WjIxVYaj2bDNL8Tw4nHfV86Axav/wBwFDYRmohQXC68ZE6FtPBDBRbb1wsJgI7wi1GAoWt27cLjujQ81ZljVT8TvVsqzDLRtCG8IDsiG0ITwIRq49DybCyPUGMZENoQ1hB4aapiEs/nbh0KHDaYf8TrUs63DLhtCG8IBsCG0ID4KRa8+DiTByvUFMZENoQ9iBoWwIHTo8RkN+p1qWdbhlQ2hDeEA2hDaEB8HItefBRBi53iAmsiG0IezAUDaEDh0eoyG/Uy3LOtyyIbQhPCAbQhvCg2Dk2vNgIoxcbxAT2RDaEHZgKBtChw6P0ZDfqZZlHXb9KbNlS2SQ5sZ5iporJP1Igj//XECWj5xh7VoBViTODUHtExxCxM2ZH3+MDLZw663C9dcLEe9k7rgjMjBI0E8/RQa1J54YmYivMrAAsE+ffRYZOiK97PSZZyIDYVX33x8ZvKM4VdmgxGfKw8p3GcwLl37++cLFFwu4n7b5jcYPyvXKcxl8Yr/5Rrj0UgG3mzb7lXtxcasq0lqeLDJXZMzvalqPJBg/segLMC+GQi1GRmNYAiwS86LvRPPWE+HoYBgAJoJPq/cLsAzU1i69NpP1MtAYy0At/CG2Xx8dGmMibBCNAbaAeevGqK0/z/UiG0NoWdYMdTARsRrN7xNLF6dFdlzKFNYxIxtCG8L9wqpsCG0ID1I7k9qnYV70nWjeeiIcHVxNbXJsCIujQ2NMdEwYwuJvFw4dOpx2eDARGdC8aqh8PlVl9TYYanwIWsahWhWDF1UjDTVoy9sSa6XJhtCGcL+wKhtCG8KD1M6k9mmYF30nmreeCEcHV1ObHBvC4ujQGBPZEDp06HBp4cFEZEDze/996AtR3qul9F2klnGoVksZfKhvW96WWCtNNoQ2hPuFVdkQ2hAepHYmtU/DvOg70bz1RDg6uJra5NgQFkeHxpjIhtChQ4dLCw8mIgOa3/vvQ1+I8l71tplP6kq68i7slMNRm66kC3PJ/qYajh7QstOoBEL5KOza59pRYaeuMFe1LUclXXkOrZUmG0Ibwv3CqmwIbQgPUjuT2qdhXvSdaN56IhwdXE1tcmwIi6NDY0xkQ+jQocOlhQcTkQHN7/33oS9Eea+G2rRj5pK2tnvIz3iow9wXIao6oRDNersPPY9CPGT1FlorR49ncFNo47XeyqDxqacKcZISnyjPKC9mcP3jP/8pNIu8WNB5b79diNilwKj8LOhQN94owJdecomAazbheU45JTLIvuCXdusVrPWtqjfdFJmzzxbQGN4yTg5BbQxuRo24XRETu2tXZNAYy/j558g8/LAAW45zjvg6g5FxcShywog7lAcU+Wwgnd68WfjiCyFih/JlBm9w77/BAjwPFl1nzPAP+GAB5NOYCNdsYlXoi2VgqLoxajERDgfbr88KoDE2iMOBT6vP+V31HvisYAsA269XhR1hKKwKjfF7CPSt3yBqcRUq5kVjnEb9utEX28fbxxbe1beAk0StjjxnWdZMtT8hHda8aqh8PlVl9TZA40WGKB9pqDHCofLecKS6zdiRF1k+Um+htXJkQ2hDaENoQ2hDqIdjQ5hB7bFoCIu/XTh06HDa4f6EdFjze3/G+zRUXqjrgr6LDHtnHGqMsC2Hcu1IKBwKl1g+Um+htXJkQ2hDaENoQ2hDqIdjQ5hBrQ2hQ4cOlzXcn5AOa37vz3ifhsoLdV3Qd5Fh74xDjREOlRequ4wdeZHlI/UWWitHNoQ2hDaENoQ2hHo4NoQZ1NoQOnTocFnD/QnpsOb3/oz3aag8C226cKi8Def3qfcZD23Y276tGoXdc1bRJo889Dx6QIjy3hJrpcmG0IbQhtCG0IZQD8eGMINaG0KHDh0ua7g/IR3W/N6f8T7NN2KLfeptgJJc1ZV0DXJtLl9MSVeeG3QluWWvchWaoSqrbZBDNMtV1grVDz8IGzYIsEAbNwpIviOeV67LfPVVZGKPEtdm6OLQeJ3Aayfj48zVV0cm4jbh/BDi1QxdzVYlHsq8+mpkYAj/8Q8BRwfBesEA4/LPiKsyuPuU3iOuVuTYuYyzI3PvvQIaY94dOwRk16efLsDUrV8fGVzQCpe+apWAW2S//16I2J1B0osd7dwZGX4YdKiTT44MPu3YwgMPCMx6sSzktUi+kW0jY35Xk2Bk20jNMXJdizwejbGjvV8zmf/4D6HeQu1MMBGWgaGwDDTGyNggllGPjLOqjw4+DT8qaFx/VLAM1GK/qH1XPypojHnRuD4NTASwfbwF/KuKedEXI2NV6KsTzVmWNVOFNaz5fWJpqUNoP2kX61iTDaENoQ3hCOzIhrCqhVGp/QMcgg1hxobwyDCExd8uHDp0OO0wrCVrfu+/twceumfLWqxsCG0IbQhHYEc2hFUtjErtH+AQbAgzNoQ2hA4drvgwrOXQ/AGxwrLGyobQhtCGcAR2ZENY1cKo1P4BDsGGMGNDaEPo0OGKD8OyrNnKhtCG0IZwBHZkQ1jVwqjU/gEOwYYwY0NoQ+jQ4YoPw7KsWetPGeTEX34ZGdwkuX17ZJDXffqpEHGR8lgGeXzEZRk4ohNOECKeVuB5PlXEEF50UWQitmWefTYyEd9kmr4vZWCeL7tMwPWtL74YmXvuEWBTTzwxMriiE31XrxZwkjBmeKG4VLYx/NAvmUcfjcxrrwnffitEXKrIREinH3pI+O47IeJJRT5IcWJkMDKObt06IeI3GeTtjV38RPlA+VVAAo2cGLn4RLVYJVJk7B99YQnQGMk3fAuGQi2WgaFgF3E4SOvreQH61nYCy0Dfegv1wWJkUK8K+8Xb/9vfBMyLkQE2WJ8VeO+9irZ9Bmc10QvF9tEXy8BJ6hucsyxrptJ0wrKsGciG0IbQhnABG0LBhjCDvvUW6oNtTWCmXhX2i7dvQ5iZ0BAWf7tw6NDhtENNJ3o0f0B+nvmzdazKhtCG0IZwARtCwYYwg771FuqDbU1gpl4V9ou3b0OYsSF06PDoCTWdsCxrBrIhtCG0IVzAhlCwIcygb72F+mBbE5ipV4X94u3bEGZsCB06PHpCTScsy5qBbAhtCG0IF7AhFGwIM+hbb6E+2NYEZupVYb94+zaEGRtChw6PnlDTCcuyDrvOOku48EJh0yYB7jHibWFrCPFUBs4k1guvvy7EFiXuzbz/fmQefFBA4g6bGrEzc/75kYEfjrUhrBKefFLAnZy4CjXiNUXuEd2yJTIXXCBE7BJODUFv3cT2P/wwMvClMO1I1bBIjAwXh7tPeZJ6Fep110UGN3by2NXDR9yTwQZjo4BLCptfJcCIXp956qnI4Cdl2zYh4vsMfo4iLhGOD6G2BHUtnAmSYNQCpMi1B6idCUBf5PGYCKvCO6v7AiwSZgNMdLCoBe3gmXadGfxzhr44WGwQy8Dbx0TYLyaCmcRE6ItV4fcO9S84MHK9yHqDACNjkeXhzFmWNVNFqflSbL2CtS/dsqxDkg2hDaENoQ1hT2qOiepsG6BvbeqwKhvCDA4WG8QySs/D/WKiFW8Ii79dOHTocNphlMr2rxVbN9qXhFC5UNOVnsJc3jYYKm+rRmrL25JD03KNY61E2RDaENoQ2hD2pOaYqM62AfrWpg6rsiHM4GCxQSyj9DzcLyayIRxOVR06dDjtMEpl+9eKrRsdyEP6S9qqurwNh57bcKiwLTk0Ldc41kqUDaENoQ2hDWFPao6J6mwboG9t6rAqG8IMDhYbxDJKz8P9YiIbwuFU1aFDh9MOo1S2f63YutGBPKS/BFWd2vKiS1HVqm2TS0ZrGyk1WVR5rhoq7Kq6QstakA2hDaENoQ1hT2qOiepsG6BvbeqwKhvCDA4WG8QySs/D/WIiG8LhVNWhQ4fTDqNUtn+t2LrRviSEng1hq7a86FJUtWrb5O5Dz6MHhEX7sc+WJbrySgGJLLzWOecI+LKO+CiDJCHiw8yOHZGJeFbY+3HNaJYPC3SR3va5fr0QcV3miy8ig9svb7hBuO02IeK3GTiEiHcyq1ZFZudO4bjjhIifM2eeGZk4RXj5ZQE3lGILOCu8wYjPhL0eaZgnnhB+/VVo7OL7CmrlNwv4IN10k3DxxcIddwijf906xabI4LLT884TNm8WsN/rrxdoU5VbbxVoU+PxzOWXR4apOY4DeW2dQCP5RhJcmw1YAiyjrsWqUFtn+egLsGZssN7RG28I8HgYCquqt4CJAFYF2j0WYOR6+1hz3Rj/QGNeDIUPElaFvvio1H1BvaOJ3gJWhdNQ5izLmqkO5KT9ogVUsXWjkQXqjBDC0fPBLCIVds8oKapGz+1oWblBp64KLXPYaWz7RZZb1kHZENoQ2hDaEC5QW766FqtCLRZZ9wVYMzZY78iGsGhsQ5iYK/924dChw2mHB3LSftECqti6UbZD+flgi6SiwWKqoN7ythArzMpt2vLcIIdonMsPtrasLBtCG0IbQhvCBWrLV9diVajFIuu+AGvGBusd2RAWjW0IE3Wq6tChw2mHB3LSftECqti6UbZD+flgi6SiwWKqoN7ytrAYeSSUD7UfKu80VG5ZNoQ2hDaENoT7qC1fXYtVoRaLrPsCrBkbrHdkQ1g0tiFM1KmqQ4cOpx0eyEn7RQuoYutGvS6oK0Tt2PI2HHpuw6HCPGnvaCj8/+y9C6hl1ZXuPykkiIh/EQkiErwi4vXaXq/to2KMMWVpG1/x/Sy14vsdo/EZk9b4iu+3xhj1lMYYY6ptr3jFa8e6aa9t27ZXRETEFgkSGmlCE0IIIuH8Lfepdcb3m3uNvXfts/euqvN9fIQ95ppjrTnnWnXW+O0tM137t33uhPhgWZSB0EBoIDQQrnSOfPlRjApHMcg8F8aYMcF8RgbCpLOBMDgvVR06dDjqcFVN2l1EQBV7V+pKQbFRqohujbG97tDWXh/qqG6PLW3psTEemu296mjdHhubz5YlQtULAtxrLzEKqlL2j64I4VwxNuEsH6ivjL7zzhINEivl3uj40H/+rL+rlkE+/niJJvJtJt5iCzE2pVy6tES/8Ya4LBAD28o2Ym6yin01ty7i8k40bllZX62nuvnmEr3hhuJSfh/99tslunxBvGyZGBullnJ+dAXAcqGycRGXs9WC9EccUaKxGitWlGjsFFrWE4MtK4p7JnrTTUs0lo4XwlcYipp8rvIiGEcxQ+xRiZo4PxXKaxTQ6IwaOr9QXZ1H40LIzXehzAeJXJw5vy64BYuTUw2GkV8XvIRcXDcfRr0g0eiMC9X9o/PO+ZjROT+KU31W20XjKIx1htEZw9DOL1mWNVGtrEcty5qgDIQGQgOhgbB3pW4gjMaMMIz8ugbC5FSTA8LktwuHDh2OOlxZj1qWNUEZCA2EBkIDYe9K3UAYjRlhGPl1DYTJqQyEDh3Oy3BlPWpZ1gRlIDQQGggNhL0rdQNhNGaEYeTXNRAmpzIQOnQ4L8OV9ahlWROUgdBAaCA0EPau1A2E0ZgRhpFf10CYnMpA6NDhvAxX1qOWZU1Syi0oZLGh5TbbiMvO6mn1huLNNhPjVIArFNCl/ECMartcGA0yeewxMWFj2yIu/xGNU338sfi558QV85wYDRAt5SgxKG4H8TXXiEu5UX2DmItzcjS22SzldDFuKDltaTT21cT+tFtuKd5oI/Emm4hLuV28Z4m++mrxvvuKS9lXrCu5887iJ54QA49LOVMt3ztgZ1Tui1v+ItYplPJc9DvvlGgWsqAaIB+c5w5Ui+fGqWrMS4zrgi0xBeTiWyjQFDoPNP18kMjFIHMwwyCRmxunguv7Eo1TYZD1taKxdP/wD2JwGjpjJbF0ufEwYEb1CkQPdAdh7fySZVkTVbEsa8IyEEYbCA2EBsKuxqlQi+fGdQ2EiXEquL4v0TiVgTCxdn4p/e3CoUOHow6LZVkTloEw2kBoIDQQdjVOhVo8N65rIEyMU8H1fYnGqQyEibVzXqo6dOhw1GGxLGvCMhBGGwgNhAbCrsapUIvnxnUNhIlxKri+L9E4lYEwsXbOS1WHDh2OOiyWZU1YBsJoA6GB0EDY1TgVavHcuK6BMDFOBdf3JRqnMhAm1s55qerQocNRh8WyrMmKe1SW66JJgAoqBx8sBrccd5x4443FpbwffeGFJRpUs3ixGDtYYhj//u9iTkH3PgXxlnKg+kPxFiWaO5QqTJatili3rNx88xKN/UsPPLBEc//ScowaY5Y7iB1K775bDBIDtpXy72phywULSnQpr0V/6UslGvPFTqG4+zvsIAZan3tuicYes5ddVqJLeUIt863u4AXqO9Vvq2+OBgCX3dV4kPCtRF7W4yiKYHQGPqFERmccBQPgKOgCXIq9TzFI8APOjEo9HyRYC0dxIZwqHwb+meWwkd8yrBVOhXuUr1VNMokxKtyjl14S59SKU2FUOIrFwagAkyDAF18U48w4Vb5WeS4m+Oyz0S9ZljVRlVSXHXJAYvaeI32+a/3ENNmrW/NRBkIDoYHQQLjSBkIDYWOcCqPCUSwORrWWAGHy24VDhw5HHZZUNQQOBISoE2J76EXlRzuq+9Qtq6e5Oo9l9SsDoYHQQGggXGkDoYGwMU6FUeEoFgejMhA6dOiwV1hS1RA4KBAmYZv66Vb3qVtWT3N1HsvqVwZCA6GB0EC40gZCA2FjnAqjwlEsDkZlIHTo0GGvsKSqIXBOgDC2N1VEbOnaHlW34wxd0/tpj4faGptDTaNlrb4MhAZCA6GBcKUNhAbCxjgVRoWjWByMykDo0KHDXmFJVUPg3AJhp35IGmN7VN3YNb3r+REm/Xt+tqw5kaDI739foqvyWmiKO5TupF5P/P774lKeVS9VC4r85S8l+vnnxdhJspSPxBvKZqedf0KNSnlB/FlDdLk7eostSvSJJ4rLpuryfDSv+4USvWSJGGPGaqCwefppMVjrd78Tk3m2LNEoia+6SowtSTfcsERjJ1gUvVhYrAYAGFuhbrCBuJRfi/VLCoBJKW+JdWE33VSMfwulPBm9bFmJvvJKcSU91V5FXFaI/9f/EqO8RtWLo9jrFsU3CmggX164YymBEzgzOuNC6Py//7f4178WY4I4Mx4soBdgA0uXnwpHX3hBDHzCamAK+eLgujgVpoBTAZ9wFMbi4Lq4EGgKf2Vg5OangnFT6vRoPAwwOuPMuC5ydTVesixrooqvz1o1BA4KhFGxHR+i0NjWp1ZzCD1j2Khn/z7bLWt4GQgNhAZCA6GBUI8aCBMjNz8VjJtSp0fjYYDRGWfGdZGrq/FS+tuFQ4cORx3G12etGgIHBcL8c2xshMZ++sSW2RJnlWKfuj12iCE6x/bZ3pY1FzIQGggNhAZCA6EeNRAmRm5+Khg3pU6PxsMAozPOjOsiV1cjL1UdOnQ46jC+PmvVELjaQBjD+kNUW1bemJ+zVO1t/dvaG7W1W9Zqy0BoIDQQGggNhHrUQJgYufmpYNyUOj0aDwOMzjgzrotcXY28VHXo0OGow/j6rFVD4JwDYdfGzoeuYVtj13OiPTZ27d/2uRPig2XNlQyEBkIDoYHQQKhHDYSJkZufCsZNqdOj8TDA6Iwz47rI1dXIS1WHDh2OOoyvz1o1BA4DhE1LbG8KEvRpC9sau56zPlXTGA/N9l51tG6Pjc1ny5oDvfOOuCxUl6ejP/20RJdya/TNN5fosrO42mX0EPGORaxbZf7hDyUa+vOfxQAGFMxArw8/FJdyhBqEsDj6/vtLNDbS/Ogj8dKl4k8+Ee+/v/g//1OMvTGxnemWW8r+lnApy6MBV/GvzGcCIH3wgXj99cWguBtuEGNH1oULxfjeIcdFDAN3cJNNxPjuAFvOYjVwIWxm+/jj4lIuUd+oxqPyrvrjaIJoXm2DAXLkAwMAReC8gAYC5Z1xFIPE0XwYmFFe9A8DV5gCjuJUuBCMU2GCODMWJ58Cng10BnhjvhgVjg70XOEoJohvFgD8uO4/pVAH5/cIp8IgkQvC13W2LGuyCjWdZVmTkIHQQNjIQGggnLWBMBoXgnEqTBBnxuLkUzAQJvcIp8IgkdsLCJPfLhw6dDjqMNR0lmVNQgZCA2EjA6GBcNYGwmhcCMapMEGcGYuTT8FAmNwjnAqDRK6B0KHDNTgMNZ1lWZOQgdBA2MhAaCCctYEwGheCcSpMEGfG4uRTMBAm9winwiCRayB06HANDkNNZ1nWJGQgNBA2MhAaCGdtIIzGhWCcChPEmbE4+RQMhMk9wqkwSOQaCB06XIPDUNNZljUZXah+Uy2F7FXcdvIa9atiZUugyL77isv64h/8QIzdPlHHf/xxicb2nocdVqKPOUYMpiWobC8GAW63nRijAj5dcIG4lLfF2xZxOVN9s1jxCayFYWBn1FL+U6wbw2LZL7lEjM1dseXs7beX6IqIZrZI7XinnUo0xlw2K9EPPihGmVd2V+ujUsoSMb93ODV6hx1KNNiylNei7723RGPX3GoP0qvV+q8s32YzNwApZ8uaZKJxKhiggjHjVLgu6nh0zut4DANnzlcD10UuOud3IR8kAAkTxDDy1cCpMKo6PTHOjGcDnfNlH2g18gvhOwucKp/CQM8VxgxM1YV9ybKsiapYljVpGQgNhAZCA6GBML0L+SANhNH5hdZUIEx+u3Do0OGow2JZ1qRlIDQQGggNhAbC9C7kgzQQRucXMhA6dOiwCotlWZOWgdBAaCA0EBoI07uQD9JAGJ1fyEDo0KHDKiyWZU1aBkIDoYHQQGggTO9CPkgDYXR+IQOhQ4cOq7BYljVZ4R26YIGYhex2JbqCDdka9CPdZrOUP6pPjsaOd9jC8ZprSjT4oQKVRWKFumqj1BXRb71Vosuu6vKR+nz1ldHXXVeiS7ksGjCJYQCuUF+VjcS40NVXi3FDl+pmp9hFllvObqIur6vvjN5++xINAsRaYYfSUn6rviEaBWQpR0UvWlSi8RCW8mR01fkYtXyVsOGGJbqUN6Lfe69El63UZWk0vg0pX1TjHyHKXBhlLvgBpTkKaBzFmfMqH8ZDiSnAedEP48yYAowz1x2iwbRxGf+pgsncmCAulJ8ZK5kTYL3yyV2A6/79G1OA67uWGIuD1cCf/uXLxfjjXo8kGlNALh4VHcZLlmVNVCXVVanYe03Vyu+71wCtIcOw1jihsDEQGggNhAbClUZnGA8lpgDjzPWkonFmTAHGmesO0QbC/o0pwPVdS4zFwWqsMUCY/Hbh0KHDUYclFRFQxd4taorGftqbxnioa2NU1w71h35Ud65bVk9zdR5rXRMKGwOhgdBAaCBcaXSG8VBiCjDOXE8qGmfGFGCcue4QbSDs35gCXN+1xFgcrIaB0KFDh6MHwkhBg37OG6PyDvlRqO5ct6ye5uo81romFDYGQgOhgdBAuNLoDOOhxBRgnLmeVDTOjCnAOHPdIdpA2L8xBbi+a4mxOFgNA6FDhw5HDIRtCFS3Ny31obbGqK4dup5ztoTtllK6naqf9H7a46G2xuZQ02it+0JhYyA0EBoIDYQrjc4wHkpMAcaZ60lF48yYAowz1x2iDYT9G1OA67uWGIuD1TAQOnTocJ4BYad2rT9H1Y1dU/C58wFh0r/nZ2teScr6118v0WVrMXbO3HVXcQWTS6KfeaZEc/vHvYq47Ke+Wf1ntewVeffdJfqzclusTFud6sHozr+KRoC6Ul6OPv30En3IIeJSzlbfKl6vRF94oXjPPcVXca/Xd6MBhHfeKT7iCDGOYuk22URcFqhJU29Fb7ZZia7uoK7k51vLzhp7gW4m5n6tm6u56aju17pxES8UozI/91wx/i1wCjizbsFaygVirCQY4LnnxChkUfTnxfc//7O4rvujATko3HEqHMWogF4o+rHQuO6//qsYnf/hH8Q5mCEXg8QUQBfYlBKnwrLjVBgGOv/Lv4hxIdxu3CNcKJ9CfYujsRo4ijcBzpw/sbhHWA3MF4uDxyylOA4jv2V4JvXoS5ZlTVQlVcS/WuxdqQ1v6vampSr/WhujunZIPnQNm8ZazSH0jGGjnv37bLfmjwyEBkIDoYHQQGggDJ5/QJj8duHQocNRhyVVxL9a7F2pjXDq9qalPtTWGNW1Q33O2bJylWZ7r1Ld2LQwOfTs2h47xBCdY/tsb2s+yUBoIDQQGggNhAbCYAOhQ4cOxxiWVBH/arF3pTbCqdublvpQW2NU1w71Obt2g+o+PdPR3ta/rb1RW7u1zstAaCA0EBoIDYQGwmADoUOHDscYllQR/2qxdzdFyBn0c94Y1bVD0xg/rMa1eqajsWv/ts+dEB+s+SYDoYHQQGggNBAaCIMNhA4dOhxjWFJF/KvF3i0KtVzv9rpbW2NU1w5NYzzaXLRrSul2qn7SY2M8NNt71dG6PTY2n615pPg0rHwIlEzKBmqlR+zixlNtWKIfeEBcviD+7W/FpRwYve++JbqUZ9Wgx8Xqj8U6qk8+EZfynHiPIi6HRS/ClpXbqMsl0WC8SkoXn/1jjG62Oe24/CB6881LdNlSrRjDvTHLIdGckfISlg5jBogOKIHJ++8v0YMJbJmKN4VPeybsffqHP4hzPfSQmGUuCmjQ1AsviFET4yhKc1wIZwZc4cwYFfgBxTf4IS/rkQtCQC4miM75IDEjOF8cnBnOEQhnzmeEzk8/Lb73XjGO/v3fi//LfxFDW20lxndF3/ym+MtfFmObYHxlhb/X+LOy007i444TH3SQeLfdxLjQV78q3mUX8ZFHivGvXb8Me8myxq4pK4h/oCzLGrNIcQZCA6GB0EBoIDQQzjMgTH67cOhwFOFnFOSwMf9AWZY1ZpHiDIQGQgOhgdBAaCA0EDp0OMowB6T5FvIPlGVZYxYpzkBoIDQQGggNhAZCA6FDh6MMc0CabyH/QFmWNWaR4gyEBkIDoYHQQGggNBA6dDjKMAek+RbyD5RlWePWNuJt1NAjj4gBGwBCdt5ZrQyACz35pLjSX9Sixx4TV/pELWLuVuIttxT3mC+3u3w7Grm95iu5OLZsmbjSp2oR56vCw4AxM1cfhlI+ikYu14oa1Vo98YS4kjwbuC7nu514vfXEPXJB2ieeKF66VIy9X2+5RXzsseLbbhOjJr72WjFyTzlFfPbZ4nPOEd9wg/iYY8RXXim+4grxkiXi++4T77WXGIO8+WYxOl9/vfiss8RgnosuEudTwIUwhZtuEqPzJZeIv/c9MRDossvEuCmnnSZevFiMtcqncP754uuuEy9SisMUvvtd8QkniA87TPytb4m/8x0xRoWnDquBzt/+thhfSh11lPjkk8X6TE5ZljVR8W1sWda4ZSAMYu5WBkID4Yw4XwOhgdBAuA4BYfLbhUOHDkcd8m1sWda4ZSAMYu5WBkID4Yw4XwOhgdBAaCB06NDhXIR8G1uWNW4ZCIOYu5WB0EA4I87XQGggNBAaCB06dDgXId/GlmWNWwbCIOZuZSA0EM6I8zUQGggNhAZChw4dzkXIt7FlWWPX+9EoZJcvL9GVsuKbudyxMyv6n3qqREMLF4qRy+J7K3X5k1r04IPiSu9E47rYc7VStla9QOXP0bgu56vabDMxlOeW8mE0rvvccyW6UnZ/n322RFfKch9/vERD2IYQ4nwVYjfdVNwjl8rGjP0sywJ1XiKfeab40kvFZ5whBnpdfrlYd1Ys554rBhL84hfiffYRo/gGiGKQP/qRGPgEbsnxCWU9EOiHPxT/4Afi008XA60Bk0AvLA7QGjCJW/a3fysG8GObTSwOVhIgetddYtwUfB2AlbzqKvHhh4vzhcUEAYSA9osvFmOt8ExiVHvvLcZOoXi8cWYsLO6vfsExZVnWRMU3qmr6nzOvjfqsMGDTKDXmy1lrqQyEszIQqgyE7blUNmYDoYHQQLiGA2Hy24VDhw5HHfKNqqohcDWAsHkj80A3oVufWf2r6wnrxrpl9TRX57HWbRkIZ2UgVBkI23OpbMwGQgOhgdBA6NChw7aQb1RVDYGDAuF0IKL4uU399BlGXc9fN9Ytq6e5Oo+1bstAOCsDocpA2J5LZWM2EBoIDYQGQocOHbaFfKOqaggcCAinKxxqWvCyrhvRv+vRpkPdHhtjO/q0NSKlPk+f7fFQW2NzqGm05psMhLMyEKo+NBC25lLZmA2EBkIDoYHQoUOHbSHfqKoaAucWCLt+7nxAmPSPKf2cJ7a3NXY9Pz53PiBM+vf8bM1bvRrdeSYa5aCy1VZiKC+gd9xRDOW5pXygFr3wgrhSVri/+GKJrpTloiu2uIOqCS6NBvFCVS6UDfLll0s0ySTNXbGiRFfKto3Nx4z9DqE8d//9xdAbb4grZfPlWlFZbj5mgFg5+mgxqnzsu7jffuIbbxSDLbE6qONBjyedJAYSAFQwKnQGH2KfyZ13FoN5gG2HHCIGewD58K/u9tvFGMa++4rBeAcfLP7KV8TnnSfGwoJMsOvm978vPvVUMa4LuDrgAPFOO4mxJ+eBB4qB9EpE/EeInW8xI6wV0OvQQ8WAyd12E+NNgI1DcUO/+U1xA9UdgzzxqOBUt94aPWVZ1kTF16SqhsA5BMKRtkNt/ZvGWs0h9Ixho579+2y35qcMhLMyECa5BsL+c/MxGwgNhAbCNQ0Ik98uHDp0OOqQr0lVDYFrERCuqgtmVHdoVDfG/lDsU7fHDjFE59g+29uarzIQzspAmOQaCPvPzcdsIDQQGggNhA4dOmzM16SqhsC1BQj7bG9rzPuXqr2tf1t7o7Z2a17JQDgrA2GSayDsPzcfs4HQQGggNBA6dOiwMV+TqhoCBwLCosCDz02Iz02fGK5G/9jYtb1R3dj1WmiPjV37t33uhPhgzWcZCGdlIExyDYT95+ZjNhAaCA2EBkKHDh025mtSVUPgoEBYVrHQtFZr4b0th9DS9RAam88IY+emHf3bGrueB91iYzw023vV0bo9NjafLWulqi0c740+4ogSDeVFMIAhPpGf6bXXSnSld6OR++qrJRpasEAMVfMVXXCBGMpzv/tdMfTWW+JKHybbe3KtdlenW6G+916Jxjab2OEPqr4deCUaJTGUPxvIxZjffLNEl3JY9AYblGjkfvBBia70qVr0m9+Iofz+PvmkGLrmGjF3gwTyYY9K0NRXvyoGqJxyivj448UgQOz2CXwC8mHj0MWLxTnygXlARFhZ0DMACXuBgj1AvKAabBwKbAOI4i4ANnBHL7pIjOljL2M8/dgMExtp4rqYAracxbcDN9wgxsL+5CdiLB0g9t57xWedJVbW4u6mML47wEOIo5gCNqR96CExLoRnQ79JmbIsa6Lia3JcmjYIWVZXVZBjIDQQzshAGJXfXwOhgdBAuHYBYfLbhUOHDkcd8jU5Lk0bCC2rqyrIMRAaCGdkIIzK76+B0EBoIDQQOnTosM+Qr8lxadpAaFldVUGOgdBAOCMDYVR+fw2EBkIDoYHQoUOHfYZ8TVqWNVlVkGMgNBDOyEAYld9fA6GB0EBoIHTo0GGfIV+TlmWNW7rPJIGh7Bu93XYlGm9ngso26vJR9ECFOzYLhF55RVzKkmgW36pHHhFDqFQx5rffLtGlHBINEEUu57u9GPNFbrXb54nRKBGh5cvF0NVXi3Hdap1PVotIvLuKt91WjAu9+26JhrSQY+7zz5doLA6qXORWxCvClo3IfeedEg1ttpmYwlaZKIJBCKjF77lHfMst4mXLxKiJcb/vv18MBMI/JADhHXeI77xTfPfd4kcfFeNxx5l/9jMxpoB9NbFBK6aALzzQGcPAXchHhX91OajghuIu4IZizPmjgs6Yfv4w4N/G3/+9GBNE5wceEIPEwMMwCBBnBlpjYYGpWBw8G/jDoYOcsixrouJr0bKscctAaCBcJQOhgdBAOGMD4TwDwuS3C4cOHY465GvRsqxxy0BoIFwlA6GB0EA4YwOhgdChQ4fjCvlatCxr3DIQGghXyUBoIDQQzthAaCB06NDhuEK+Fi3LGrcMhAbCVTIQGggNhDM2EBoIHTp0OK6Qr0XLssasN94QQzmZcBtGLfpRBCK3Kr7PjD7//BKN3JdfLtHQHnuIobxw33prMa5L4t1ZnK/Vr39dokFT2DoRufmWlSefLIZeIcWJ8rUi1JWzo/P5cutXfTby3KeeKtF4NlA/Q9WzIWM+7rgSDfF5Lk9E49mAnn5aXPYUg49KeUqMEhk1Mbb3RImM4hubUmKxcGYgAcprjOqmm8TYG/Pii8W40NFHizFITAGnAoogF/9yat6IBj5hx07sbgqaQmd8GYYp4FTXXivGFMDhS5aIsRrARSwsJohvB/D9Fo7mDxK2nEVnfK+2dKkYX2H8/OdibP2KPw2/+pX4nHPEeE/giwZ8hXHiiWIdxpRlWRMV36mq6aefTsze66imW/4vE9vaLWswGQijDIRRBkID4awNhAbCdRoIk98uHDp0OOqQ71RVDYGDAmGsMXisPyFxtc/TKA6pETsFtR1ta7eswWQgjDIQRhkIDYSzNhAaCA2EDh06HE3Id6qqhsCBgHB6Llhu9bL6UZ9nbuvW1m5Zg8lAGGUgjDIQGghnbSA0EBoIHTp0OJqQ71RVDYHDAGFUrD26trd1az50Pdp0qNtr1UebrHgoNqK9a5+m0bL6koEwykAYZSA0EM7aQGggNBA6dOhwNCHfqaoaAucECDslR8/P+FC39/zcCZvPUNuZEbadvK2x+WxZfemZZ8RlWvzJJ2JqgXojcedxbITU/GiuOcyFttmmREPYLLBsLc5zUTIhd8stxRhVnrvRRuIeubur9XYPllteie6Ru1Bd3o7ukbuTWnOxzjk8jy630ptqES90333ib3xDvHCheIcdxIsXi/fbT4zcHXcU/9f/Kj7ggMxf/ap4p53Eu+4q/spXxJtvPoD/5m/E2DoSawV8wrcj+FIKvHTooWIgEP61A62BMaDl00/PDMIHEJ57rhidAWYYFRDokEPEQFzcX6A1vjvBsu+1lxjfLBx/vBh3cNEiMS6EtTr8cDFu95FHinFmfCuBUSnST1mWNVHhLQnVEDgQEBat/WJj6CJkFdu7NrZ17tleKzlU+jhh/aFraFk9ZCCMyqHOQGggbMutZCA0ELbYQBi9xgBh8tuFQ4cORx3iLQnVEDgoEEZNB4KC0CEKjW2de7bXqg/NDuhzNY3oU3+AZntbVk8ZCKNyqDMQGgjbcisZCA2ELTYQRhsIHTp0ODkg1CMz6tqOxraT9GyvlffsecL6g2WtjgyEUTnUGQgNhG25lQyEBsIWGwijDYQOHTocMRBOt6NUPNS1vf5Qt7d97nzoGkYlPZOT1xeKjbHdsvqSgTAqhzoDoYGwLbeSgdBA2GIDYbSB0KFDhyMGwqK130DtbS1dD6Gx+VyHUfWheLbmaNPYHGra4+e6g2Wtnj5Vix5/XFzpE7XoscfElSQ3PtOfKc9FZ6jK3TcaFNcjV0ks35I0zy3lT9E9ckliH0cjl/eIuR9GI5ckRr0bPWDuG9HIXb68RFd6PRq53N6Tyiju2WfFeDby3GGuy21UUciigEYRjI0Wkfud74gvuUSM4hvohfIae2MCU1G4o9oGe2CQV14pBsVhgmAPbLKKnVFPOkmMXKwk8Omgg8RHHSXGBLHOuBB2GcWYL7hAnOdikKecIt57b/HZZ4uxzoDJAw8Un3WW+MILxdjPE1PApqNXXQqUdwwAAF9USURBVCXGhrRYDcAk/vbhqcsfb+xQisUBH/7oR9FTlmVNVHhLWpY1cRkI23MNhAbCVRrmugZCA6GBcE0DwuS3C4cOHY46xFvSsqyJy0DYnmsgNBCu0jDXNRAaCA2EBkKHDh02xlvSsqyJy0DYnmsgNBCu0jDXNRAaCA2EBkKHDh02xlvSsqyJy0DYnmsgNBCu0jDXNRAaCA2EBkKHDh02xlvSsqyJSwrZHsX3Juryl2jkElSoP0cPlLtIq03kEq5UAEKIkLOr+ItfFEO4Lka1/volOs8t5TL1H9R5LiRAiGPcRpV6Jxozeu65El0pe65WrCjRlbLcF18s0WWBOs19/vkSXdZTl9+pRcPMl7uMoiZGaQ4k0EKW5TVKZIAZ6ulTTxWjM7gUgIR/dZgCDBQB8ul+jxwGci+7TIwqH5gKPsReoBjkYYeJDz5YfOONYuTus4/4jDPEuIO4C9iwFDPCPqIAwhNOEN9zjxh3EMSL/Uuvv14MmNxlFzGGASA87zwxdgrF0uFCJ54oxlcY994rxkpii92jjxZfd51YH/4py7ImKr5CLcuatLJC1kBoIDQQdjTMfA2EBkID4YzXGCBMfrtw6NDhqEO+Qi3LmrSyQtZAaCA0EHY0zHwNhAZCA+GMDYQOHTo0EFrWmqeskDUQGggNhB0NM18DoYHQQDhjA6FDhw4NhJa15ikrZA2EBkIDYUfDzNdAaCA0EM7YQOjQoUMDoWWtecoK2RzMAEgffSRm7kIxygCoF+SI8s4LF4oh5m4r3mEHMZRvlbnTTmKI11XtvLMYynOxNSiO4f7iaP4wvPpqia6U5b78comuNEhuSoB77FGif/MbcaVXo3HdXrmDjBnCQwlOu+oq8bnnilExA66wOSQ6o1K/6y4xNv9cvFiMHTuBXnjcMSOACnahxO6X1+pmpzgVdkYFtd56qxhbVu61lxinwiCxdDvuKP72t8UXXyzGmA84QAxQAacdcoj40EPF+Hbgy18W47nC4uC5wnUxQTxIeAjx5zsnwG9+U3zEEWKsMxYHfwrxmGEYwFRMXyc4ZVnWRMXXourfUrG3ZVlzoayuJdSpDIQGwj5zewDSQLkGwmgDoYHQQLhaQJj8duHQocNRh3wtqoiAKvauNF2VN00LXtaxMXbGIXSwrHVSWV1LqFMZCA2Efeb2AKSBcg2E0QZCA6GB0EDo0OHaFvK1qCICqti70nRV3jQtONS1vevn+pyWtY4pq2sJdSoDoYGwz9wegDRQroEw2kBoIDQQGggdOlzbQr4WVURAFXtXmq7Km6YFh2LY+Vy3tIWWtY4pq2sJdSoDoYGwz9wegDRQroEw2kBoIDQQGggdOlzbQr4WVURAFXtXmq7Km6YFh2LY+Vy3tIWWtbZLClkcI8WpsKMhlIMKikAoz0XNAOW52EoQyueLigLKrztMLqov6MEHxZVeUYvefFNc6f3oWb75XG+8UaIrZbmvvVaiP7st6g/Uv4muQHS/6I02KtG9rgtl26hW14UyIHzvvRJNXXih+LTTxNhJErtfYgfLRbr5J/ZdBPN8//ti4ASQYOlS8aWXivFvEiiCvxQo3MGWxx8vBuICCbC9J7gUW3SiM3AC6wyow6j23luM1QBc4YZi+tjeE8sOLIexIysG+ZWviPF35LvfFQPb8IcScIWdUQHe2OsVUIdHFFuSnn22GI8othXFXcAgQenYoVT/Ik9ZljVR8bWoIgKq2LvSdEVuTQte1tqLiXloWWu7DISzyuc7DNQNk2sgNBAaCA2EXWwgnDsgTH67cOjQ4ahDvhZVREAVe1earsitaakPNeocih3QOcm1rLVRBsJZ5fMdBuqGyTUQGggNhAbCLjYQGggdOlwnQr4WVURAFXtXmq7IrWmpDzXqHIod0DnJtay1UQbCWeXzHQbqhsk1EBoIDYQGwi42EBoIHTpcJ0K+FlVEQBV7V+q8iLuGsT0K/evPbYmWtfbKQDirfL7DQN0wuQZCA6GB0EDYxQZCA6FDh+tEyNeiigioYu9uwks5toderY1NS9eTWNa6ILysobfeEkN5bg45V1whhp58UgwNmHt1NOoN6IknxFB+3RwmUbdDDz0kLluIsd9h/HtU/0lCZY7Ob79doks5MBq1KHKrh+EI8WcDiVZVJLZI/edoVJvvvCMuW6vLf0RjzB98UKLLemrdghW5779fopG7YIEYuRyzCvUzN9LElwf33y/GE4wHC7Bx+eXiiy4So9oGXXzrW2JwC051991icMvNN4vBAA8/LMaZ8fQjF3+D0BmEgD05sTi33y4Gpd93nzgf5LJl4ssuE3d29WyMQd5yixhMe+WVYtwU5OI5w6OCb5JwZqzVj38sfvRRMVYSDxJOhetiVMBUPDk33ijGLcN3B3iuMCqd75RlWRMVX5OWZY1ZOdRVDCDKcw2EUSh7IAOhgdBAaCA0EE4QCJPfLhw6dDjqkK9Jy7LGrBzqKgYQ5bkGwiiUPZCB0EBoIDQQGggNhA4dzs+Qr0nLssasHOoqBhDluQbCKJQ9kIHQQGggNBAaCA2EDh3Oz5CvScuyxqwc6ioGEOW5BsIolD2QgdBAaCA0EBoIDYQOHc7PkK9Jy7Imq1deEUN33imGnn1WXHYU42XdI7csiUa5BT39tLiUK6Oxtxz01FNiCNUmiv6cALGxInLzdUY5jdx8u8sddhAjl6CyULzNNmKIMLm7+ItfFEMVTIrWX18M5VuhfulLYsz39ddLNLTllmLk5uuMWhS5L79coks5Khq5PBe+SgES4B/DTTeJ77lHjK0jsUkjrgu6QKWOo2AeIEE+SOAEzozCHagJg6YwQWAM/k3C2Cn05z8XYzXQ+bbbxPijA9YChwOQcGZsdoqdM4F8IE9sKwrEBXrlE8QwcLtxXTyxWGd0xuauGBUuhAcJfyhx95GLCeowpizLmqj4irUsa7LKQcVAGGUgNBA2Rq6BMBukgdBA2HiNAcLktwuHDh2OOuQr1rKsyeqVFFQMhFEGQgNhY+QaCLNBGggNhI0NhA4dOjQQWtaapldSUDEQRhkIDYSNkWsgzAZpIDQQNjYQOnTo0EBoWWuaXklBxUAYZSA0EDZGroEwG6SB0EDY2EDo0KFDA6FlTVwoZFesKNFlVzHqHOS++GKJRi4KuR655eRo7C2H3GpbUcnFln69ch+LRnGC3KroF51+uhjKc7HNJvRKCpP77y+G8usedpgYynN33lkMEURVW28thgii5QG1qKLHfaNJYqo33hCXPcTIxcOwfHmJxsOPb1KQy0odhez554vBeKi2wR7HHy/GURT92A3ypJPEF1wgxpa7ADNMAf+QgAS4EIp+5GIjTUwQX+HgQnfdJV66VIyNQ7E4mD5uClAEiAvmAcXhug88IMauwVgc3H1wKbacxeIA2844Q4w9ZnEh7HwLhsfzjG/Ojj1WjO1b8XhjA16sxk9/KsY3KcBFeGoq2rKsyYrvY9VLqdjbsqzVEGpTA6GB0EBoIDQQcnEMhOs6EP7b9L81dujQ4ZhDvo9VREAVe1da+Z5taeHrODTGzp0Q3SxrnVLzfHdkIDQQGggNhAZCLo6B0EDo0KHDkYV8H6uIgCr2rrTyPdvSgkNd29v6WNY6pVCXrpSB0EBoIDQQGgi5OAZCA6FDhw5HFvJ9rCICqti70sr3bEsLDsWw8znJtax1SqEuXSkDoYHQQGggNBBycQyEBkKHDh2OLOT7WEUEVLF3pZXv2ZYWHIph53OSa1nrlJ57ToxCNi+Cq+09hcRQ9pSNxPn2nrgQD6di7oISzaN57iDKc3E0V56L7Vvz7T0feUSMbUWxzWaPXN1WdJNNxBhknlvKX6IHyt1gA3GP3K3FG28sHig3384URS9ysX0rcovWpqx6ARuoxeElS8SgqYceEmO7y7/6K/Fuu4n/x/8Q77OP+BvfEO+9t/jrXxcvXCjec0/x174mPugg8X77ibffXowx41uKbbcVb775AF60SAzky0nsiCPEwCcQILZjPuQQMTYO/clPxA8/LAZ6HXmkGCQGhscU8B0Vvt77m78RA3EB7Xgx4EG64w4xvqPCNxqHHy4GTCIXxHvWWdFTlmVNVKw/VERAFXtXWvmebWnh61hVt7Q1WtZaLwNhljuI8lwczZXnGggNhK02EBoIDYSrBYTJbxcOHTocdcj6Q0UEVLF3pZXv2ZaW+lCjzqG6Q91iWeuCDIRZ7iDKc3E0V55rIDQQttpAaCA0EBoIHTpc20LWHyoioIq9K618z7a01IcadQ7VHeoWy1oXZCDMcgdRnoujufJcA6GBsNUGQgOhgdBA6NDh2hay/lARAVXsXWnmVdstjO1R6B+OMLSsdUQGwix3EOW5OJorzzUQGghbbSA0EBoIDYQOHa5tIesPFRFQxd7dxNduaA+9Whs7LW0nsax1QdiYbaBClrnbiAfLLYvVn6jTMVOjymXRT32qFuW5gA3oiSfEld5WiyaVW23fCkkuno1J5RIIqYFyv6t+Nxq55YADxADCo48Wg+L22kuMo0ACbNGZQw6GAQbAdbGxJGpxbBMMxsMwgE/YrheggmFgW9GjjhJ/+9vixYvFwAlMH9td4rrnnCPGsmN7TzAtpg8CxF6gGBWGoZDDrxJwFLnYJxZPHUAUY8bCYpDYoRTLvu++Yiwdpo9nA1M49VTxD34gPu00sU5hyrKsiYrvW8uyxiwCkoGwPTeHOgNh1DBgNqncCuqGyTUQGggNhJ97LQHC5LcLhw4djjrk+9ayrDGLgGQgbM/Noc5AGDUMmE0qt4K6YXINhAZCA+HnNhA6dOiwV8j3rWVZYxYByUDYnptDnYEwahgwm1RuBXXD5BoIDYQGws9tIHTo0GGvkO9by7LGLAKSgbA9N4c6A2HUMGA2qdwK6obJNRAaCA2En9tA6NChw14h37eWZY1ZLGS5G+SH0SxkdcvKUj6ORmeSGHP/GN0jd0v1tLhHrhLvRhuJe+RuLN5pJ3GPXBW2P0RuTjXYoxG5y5aV6EpCvMjNx5yvVbVt7CJ1RlPDkOfy5eJKWe4zz4jLeuo099lnxZXeicZ8n3++RHMv0IsvFgM2UASffbb4ggvEWvWS07D9I/jh0EPFuC7K66uuEuf8gAuBl8CW2EkSubgucoEES5eKsa8mlu5//k8xpv+tb4mxryauCwRCZ/AS4DnvDIbHSmKtzjtPfM014vy62EcUy45hANuQe8UV4ksvFZ9yihiPN6gV/1IwwTPPFOPZUNScsixrouIr1LKsMctAmEAOcw2E7WtlIFQZCA2EBsK1CQiT3y4cOnQ46pCvUMuyxiwDYQI5zDUQtq+VgVBlIDQQGggNhA4dOuwr5CvUsqwxy0CYQA5zDYTta2UgVBkIDYQGQgOhQ4cO+wr5CrUsa8wyECaQw1wDYftaGQhVBkIDoYHQQOjQocO+Qr5CLcuatN6KRiH74oslupIU0Mhl8U1luRBTdQvHTz4p0SRe6gO1KAekUv5dLeqV+ye1qMo9Knq99Uo0RCDcWrz55mKI191IvO224h65ql13FUN5LsppKM89+WQxlG/9inuEh7BXbvY8E4DBD9ikcckSMYp+GMU3SAwbaQIJsCfnCSeI77pLDCTABo/gJRT9MOr4k04SY29MrBVy8Zx94xtirBWmsP/+Ymx3edttYqwk9uTE0iEXO8ECrUHpoNZ8+l/9qhhPP2gKrIWl23tv8bW6ySq2Fc23yb3nHjHADOuMlbz1VjEIEDvQ4vsOMC1uty7dlGVZExVfoSr2VrG3ZVlzIQPhrHLYMBBmuSoDYZSB0EBoIFzTgDD57cKhQ4ejDvkKVU2lYm/LsuZCBsJZ5bBhIMxyVQbCKAOhgdBAaCB06NBhY75CVVOp2NuyrLmQgXBWOWwYCLNclYEwykBoIDQQGggdOnTYmK9Q1VQq9k41/XkN2XkXNy0x7LOPZa3zMhDOKocNA2GWqzIQRhkIDYQGQgOhQ4cOG/MVqppKxd6pOm/hGNaf6z7xUNNuWeu2skJ2oB0dkfvCCyW60qvRPXIXqNPrvvNOiR4od8WKEo1cdH755RJdKbvQK6+U6EqSu9lmJboXpb+jFj30kLhspS7vqUU5ie2+uxjKc/fYQwzluXvuKYaq3BujFyk99coVoRaF8lzuV4tzAQkAG7vsIgbUAYGw/ePBB4tPPFF8xx1iFO4o+rElKXgJ210CRXC/sTkkMOaMM8QAYOxgeeSR4i9/WYzVAB5jVAcdJAa33HSTGGfGwuJU4EMwHlYDj8pS3Tf1yivF+CoBuXhULrtMDLbEauBhwGO2447ib35TjMcbuVhYfLMA8gQfYm9b8DBGpVNggWlZ1njF16KKvVXsnWpaiQ5h18aufSxrnVfGLQbCaHQ2EEYZCKPyXFbqBkIDoYFw7ECY/Hbh0KHDUYd8LaqmUrF3qumK7ppKLLaE4wwta54o4xYDYTQ6GwijDIRReS4rdQOhgdBAaCB06HA+hXwtqqZSsXeq6Xa6aw6hT5JiWeuwMm4xEEajs4EwykAYleeyUjcQGggNhAZChw7nU8jXomoqFXtXmu7v17/mc92n7ZBlrcPKuMVAGI3OBsIoA2FUnstK3UBoIDQQGggdOpxPIV+LqqlU7F1puhv1xZaOYks4PtOCPpa1rmmYQhZ1DpRvw4iaEMqve8klYii/LuAKuDgQmDV/IDoaBgh75b4WjdyBxoyF7ZUrMInrfvBBia4kW78i97XXSnSlLPeNN0p0JYFY5L75Zomu9JxalIP3FluIofx5JvOg6kUhi4oZuIjOKOsBk1dfLQYwgKbwlwLsgVEBVLCBJwr3888X488KZnTggWIMA9uKIhcQi81O0RlfLRxzjPhv/1YMLMdqAJ9wy4BtwBjssQtcvOACMe4vZoQ7iA1L99lHjE1HcVPypcMDfMopYnxZgHXGHrNYScAzOt9wgxgPP76V0KVjgWlZ1njF16JlWWOWgdBA2J5rIJyVgdBAaCBch4Ew+e3CoUOHow75WrQsa8wyEBoI23MNhLMyEBoIDYQGQocOHY4i5GvRsqwxy0BoIGzPNRDOykBoIDQQGggdOnQ4ipCvRcuyxiwDoYGwPddAOCsDoYHQQGggdOjQ4ShCvhYtyxqzUI1AeSGLqg/KwWyYXJRM0BNPiIEEp55aovNcCHUslOdiDz/oySfFEOp26PXXxdCtt4qht98WV/okevPNS3SljHjff79EV8oo7sMPS3TZVF1+G41cLs4e6vIf0T1yy4HqP6hFr74qLuUI9Z/EICKU16h6QY/Y3hP7W551lhi5uBCO4nG/8UYxwOyuu8RAIOAT/vHfdpsYm73iX853vysGXAEIsUUnToUdLAFXF14oxhTAPLffLs6XDpBzzz1ijAqQg0cFG5Zio1TQMmgKdwELC3zCjLCrKtYKe73ib+7DD4svukh8yy1iAPDdd4sxBRzFHqTXXivWh2HKsqyJCu9Qy7LGLQNhkguhKILyXNSikIHQQGggNBAaCCcIhMlvFw4dOhx1iHeoZVnjloEwyYVQFEF5LmpRyEBoIDQQGggNhAZChw7nZ4h3qGVZ45aBMMmFUBRBeS5qUchAaCA0EBoIDYQGQocO52eId6hlWeOWgTDJhVAUQXkualHIQGggNBAaCA2EBkKHDudniHeoZVnjForgahvGw6JRQCL3rbdKdCmLo7HRIHKx2yeEigK5+VaZKIqQ+8gjJRrKSSwnwOuuE0M5AaIIhJ56Sgxh70Bo+XJxKSdGo2CGnnlGXLYT52v17LPiUhZF33xziYby7T1RBEL5dqagZTwb1fMsAgIgNwfgDTYQc99F1NN4gkEm6IzSHFV+XovjQtdfL0YunhUsJcjkzjvFoLg77hCDS/FgoTOWDhiDtbrvPjGO4rrAVPylwDoj9957xVg6rDOe/h/9SIznDAuLe4T9l6+6SgxoxzDAw1icRx8VYxj4o5MvHZ5JYCqA8KGHxHhiMUjMCMMAEOpDOGVZ1kTF1yQ0ndpapc/KDzZ9rrZ2y5oVClkDYVQOOQZCA6GB0EBoIOQfnXzp1lQgTH67cOjQ4ahDviahBGeSQ6uEFzQPr8HCyDtip6C2o23tljUrPGcGwqgccgyEBkIDoYHQQMg/OvnSGQgdOnRYhXxNQh2cwQ+DTWMvTSsOIVwr1OeY27q1tVvWrKSMNRCqcsgxEBoIDYQGQgMh/+jkS2cgdOjQYRXyNQmNDAjjizt0mW3v2hjb6z7xQ+xc58ZGtEP10a6JsRHtXfs0jZbFp8dAGJVDjoHQQGggNBAaCPlHJ186A6FDhw6rkK9JqEMu05WbQ6mmKwZrPrR97nyIn/vpHMPYB2HXPugP4VBb2HbCtsbms2XNPBCN8kJ2m23EyP3ggxJddlbrzorIZfG9tXjBAjFUQex+0RttVKIhXrccF73FFiUaqiB2afS225ZoqMoV7bqrGGv1m9+UaAh7NCI3h2fsHDlQLjb8Q24Oz9jCELkVPK+IBpggt9qu9uRosAZyn3uuRCMXnZ9/vkSjM6gVuZw/IAcIhCof8wc//OQnYnxLgXoaubhnoDjU8SCiZcvEYIBzzhFj50wwAPaKhL/9bfHPfiYGLedTAFxhrYATWHaMCt/o4MyASZAYDMY7/ngxVrJen+gzzhDj7oO1cF2MGf9ycBTXxROLCeIO4rpYuuOOE+NCmBHWKr1lU5ZlTVRSE9TqYMt05eZQKr5zQ3voJdQU27s2tnXu2Z40du3TUXKo9HHR+kPX0JrXmlYZCA2EBsKODIQGQgPh/AHC5LcLhw4djjrUoqBSB1umKzeHUq18z7Z8hupDsaX5HMNB29EIsccq1Ye6JqJb3Y6spt2y+HAYCA2EBsKODIQGQgOhgdChQ4djCLUoqNTBlunKzaFUK9+z3UK0d1Vb59Vu79nYVfnZel60/mBZ1LTKQGggNBB2ZCA0EBoIDYQOHTocQ6hFQaWEYpJDq7TyPdstnHkFd2vv2tj2ufMhaW87FBtje636bPFz1xPic90Y2y1r5uFoZCA0EBoIOzIQGggNhAZChw4djiHUoqDSdOpeWvmebWmRd7F2SBrb2jufm8bYp9OS5KIdqo/GrOZo09gcatrj57qDZVVbOO4qfvBBcXyMPtOKFSUauSgvkfvyyyUa9JjnVmRyZXSem287ic7QG2+UaGjrrcVQRa2iPPftt8XQMOS5++5iKP924IgjxFB1j0SgVijPHea6oFaIz+ReYlAbxNxydjRqUQqHjz5aDDJB4Y7c004TY/tHbMKJ4hv19JIl4vPOEyMXW2UeeaQYQAgDn1DHg8SQizFj6bDPZD79E08Ug1tArcgF82D6uC4w5v77xUcdJcbiYPrYOBRLh5sCbMPGsFi6Sy8VYzUAhN/6VmY8olg6bA2K6eOvOR5+bBuLKeCbFOTq3qdTlmVNVHwtWpY1ZhkIo9AZMhBGDQNmBkIRDqOuNRAaCA2EHY8SCJPfLhw6dDjqkK9Fy7LGLANhFDpDBsKoYcDMQCjCYdS1BkIDoYGwYwOhQ4fraMjXomVZY5aBMAqdIQNh1DBgZiAU4TDqWgOhgdBA2LGB0KHDdTTka9GyrDHLQBiFzpCBMGoYMDMQinAYda2B0EBoIOzYQOjQ4Toa8rVoWdaYVW3heGo03vu9cs+MRr0BuKpyT46+5poSjdynnirRyM2v+/TTJRq5OUw++2yJBgDfeacYO6Nyy0rNhXBdHh5Ev/2tuGykVuG6uZg8Mg10XS3zCraNRc0PvfuuGMIWrBAGmYvJqOOx7yIY4OGHxcceKwYQ4h/Do4+KTz1VfNJJYuwUin+xQE3U4rguNg7FpqvHHCNG4X7PPWLkYulA7b/8pRj4dPjh4r/+68w77CDG1zD4huPrXxfvvbd4n33EuNBuu4l32UWMo1/+shjD+NrXxBgVTvXf/3tmbHy8cKEYz+Tf/Z0YR++9V/zzn4vxB/pXvxLjQdp+e/Hmm6+2pyzLmqj4WrQsa8yqwMxAaCDsS0wemQa6roHQQGggNBAO6qn0twuHDh2OOuRr0bKsMasCMwOhgbAvMXlkGui6BkIDoYHQQDio81LVoUOHow75WrQsa8yqwMxAaCDsS0wemQa6roHQQGggNBAO6rxUdejQ4ahDvhYtyxqzKjAzEBoI+xKTR6aBrmsgNBAaCA2EgzovVR06dDjqkK9Fy7LGLILZDuL11xdDLL53F3/hC2LUxHnuRhuJkVu2LtHbbCOGHntMXLZRl0/UaS71qVrUK/cjtYg3pRysflstyhcWuVjYPHfjjcXI5XzTe9QjtyxSD3OP/qIW9crN1rm6R9Ag6wyauvxy8S23iE84QYxNV7FnI3awfOABMWgKbPnDH4rBpYceKsa+msC2Aw4Qd/Z4bQwwu+IKMfYRPf10MaZw3HFibNG5115ifO2ElYSx1yvQC8t+2GFizAhnxqhwfzEjMC2Gcc45YlwIo8JjhmFgRrjdyD3kEDFOheljRni8kRtn95nxmGFU2L4VHI69XjV3yrKsiYqvUNX0Z1VDu9nbsqzVEOtaA2GSSxkIZ8X5pveoR25ZZCA0EBoIDYSc4CiBMPntwqFDh6MO+QpVJdSXHGo0Xf+HOaPR2C5kWXMv1rUGwiSXMhDOivNN71GP3LLIQGggNBAaCDlBA6FDh+toyFeoqkN9XX8bNBBa1tyIda2BMMmlDISz4nzTe9QjtywyEBoIDYQGQk7QQOjQ4Toa8hWqmisgjC/iGMaeUU07DsVGHOqozmpaLGsNFetaA2GSSxkIZ8X5pveoR25ZZCA0EBoIDYScoIHQocN1NOQrVDWHQFg3xs+dd/Tqfe6EzWeEOGRZa552Vg9UyCowrLeeGLksvocCBigDhscfF1f6vVpUbWcKjQsYFqrLu9HI5VoRCP8zukfuVuLJ3aNsnZcvF1eSXDyic3mP+O/ow2jkcq3APEcdJUaJfNVVYhARuGXxYjHKa5Tm3/ymGDt2Yhi4Lkrz731PjN1dcSp0xpnBpfvvL8apMGbMCLyEXKwVIAf3CBu05sPAjLBBKzgtPxVGdd554kV6f3EqrAaQ76yzxMjNOfyyy8T4ZgGnuuACMU6FGQHqcKolS8R4kM4+W7xIF0dXY8qyrImKr1/VOIGwaRymvWtoWWu2WMgOUgQbCMWiuYQNA2H7OhsIxQbCaMzIQBhtIAyeSn+7cOjQ4ahDvn5VaykQdlo6QrtlrXliITtIEWwgFIvmEjYMhO3rbCAUGwijMSMDYbSBMDgvVR06dDjqkK9f1doLhI2SQ5a1ZoiF7CBFsIFQLJpL2DAQtq+zgVBsIIzGjAyE0QbC4LxUdejQ4ahDvn5VCfUlhxpNd+O3rp877+iBPnc+9AxxyLLWPLGQHaQINhCKRXMJGwbC9nU2EIoNhNGYkYEw2kAYnJeqDh06HHXI16+q/m0QvxPmmu7Gb10/67uadFe3t/VJWixrDVXzsK56ZKVwx1EWsqrttxcPlFvKn6KR+8QTJbpSBgxPPy2ulBX9OWxsvrkYuQQG6nfRyOVabSXu0Vm1cKEYub1ILLspvXKzm/LMM2Joww3FuG6em9/Qhx4q0dDOO4shrvOWYmzBCjEXQk2M/Ty/9S3xPvuIzz9fDH7AUSABymsU/d//vhg0dcwxYlTbmBE2eLz6avGBB4pRx2M1MKMbbxRjGIAcXBdE9KtfibE4mNF994nB4cBFTAGrgWU/6CAxVgM7o2KLTtwyrMYpp4gvvFCMKVx6qRjfHVxyiRj7iIL/wXh4RDGja68VH3ywGNB+0UVizAhHcd1vfCN6yrKsiYqvxQlp2uRmzVuhYjYQRhkIk5vSKze7KTnUGQgNhAZCA+GYgTD57cKhQ4ejDvlanJCmDYTWvBUqZgNhlIEwuSm9crObkkOdgdBAaCA0EBoIHTqcPyFfixPStIHQmrdCxWwgjDIQJjelV252U3KoMxAaCA2EBkIDoUOH8yfka9GyrDELFbOBMMpAmNyUXrnZTcmhzkBoIDQQGggNhA4dzp+Qr0XLssYsvGFRQPcoZMub0cgdZovO554TV8qK/mefLdGVJPeGG0p0r/n+QS1irm6jCnrskatC7Y355rn5Wg1zj55/XlwWqNPrMrecr5ZtVHHdXvP9o1rEXL1HW6t75Kqw+yOIoAc8A1RQIp90kviMM8Q5MODM++0nBh8CJ4AxAEJshQr2AGthVEDcM88Uo3DHqDCjAw4Qn3yyGPt5XnyxGDPafXcxZoTNXbH3KWa0dKkYTwNmhEECjwFX118vxvaeWDp8GwTEzR8VrCSAEGyJ241RAXFPOEEMAsRq4PHGjHBmLA6oFWM+8sjoKcuyJiq+Fi3LGrMMhAbC1btHhDoDoYGwsYHQQLi2AWHy24VDhw5HHfK1aFnWmGUgNBCu3j0i1BkIDYSNDYQGQgOhQ4cO+w75WrQsa8wyEBoIV+8eEeoMhAbCxgZCA6GB0KFDh32HfC1aljVmGQgNhKt3jwh1BkIDYWMDoYHQQOjQocO+Q74WLcsau7LCPQczFNDYpPHFF8UznNAfMLz6aomu9I5alBfuX/qSGFq2TFy2F++4oxjKr3vEEWIoz83X6oUXSnSlt6KR++tfl+hK2XV73aPVh7oddhDn2mMPMZRfCHU71IPi0sXhw0/JTSHxo5AFTqAIRqX+t38rRpUPYNhlFzGGgR0sgU8or7H3KVATJHbYYWJ0BgIBNgBmgEnMCOyBGSEX64x/7fvuKwYt65aV/HoA9+jyy8XgQ2w6ihlhs9ObbhKfdpoYM/rrvxbju0DM6MtfFh96qBg3FLuMAo/xYsAUsLsppg8gxE0B4mJbUXTGU6ffaExZljVR8SWpOnWDf0vM3kNr2v9vhNa8VFbXGggNhG3X7XWPDIQGQgOhgXCtAcLktwuHDh2OOuRLUpVQX3KoEV7QPFypnz79C2eb25Nb1hwqq2sNhAbCtuv2ukcGQgOhgdBAaCB06NBh75AvSVWH+rr+NtgnECZhrZ4dBtLcns2yRqesrjUQGgjbrtvrHhkIDYQGQgOhgdChQ4e9Q74kVaMDwvji7r9DbO/a2LR3bUn6Nx3q9rZGy5orZXWtgdBA2HbdXvfIQGggNBAaCA2EDh067B3yJakaERB23tddP3dtbPuMD/239/zcCfEBny1rbtR58hqtWFGiK2VF8GuvlehKq08IwxT92FgRynNRjUDDAMMw6/zyyyW6Upb7xhslGkIdC+VrhYIZynNRqkFV7iHRqGOhYdZqmNxXXinRlSS3XHihGIRw9NHinOKwdSSIKC+vc0JA58MPFwMYsBXq974nxkaamBHwCauR77mKQYLTcmDA0w8DVIBAX/+6GAikG1pyI03MCN9S5IPMZ6TMw2XHjHCq3XYT77qrGM8kVgNPHZwPEt+GoDOedjyx+CoBTx2moMQ7ZVnWRMWXpGp4IIyK7aFXF/Tq2SFRW+e5aresOdbKfxxBw4CKgVCVrdUw6zwMqBgIVdlaDZNrIDQQGgi7Ox/k5IAw+e3CoUOHow75klQND4RtnyH0aT7k7Y30ZN07r3Z753M8s2XNpZrHq6NhQMVAqMrWaph1HgZUDISqbK2GyTUQGggNhN2dD9JA6NDhvAz5klTNIRDGEO2N2jq0tXdtbOu82u09Gy1rKE2rhgEVA6EqW6th1nkYUDEQqrK1GibXQGggNBB2dz5IA6FDh/My5EtSlVBfcqjRdAtidd7XXdvrDslnfGjrgLDnCRHGdvSxrDlQ5ylsNAyoGAhV2VoNs87DgIqBUJWt1TC5BkIDoYGwu/NBGggdOpyXIV+Sqvq3QfxOmGu6wqemJb6466NtHWJ7W2NzCD1jSnMIjc1nhHVny5ozoYB8+20xhNcxVBXuIlQyUJ6LFz1EMNtKjE0KoV5bZQ5S9HMbVdkKFbnDwDOvqxrmHqEUh7jOKmzZCOW5qJChfL75Paru7wXq96OR+/rrJbrSG2pRvn0rn0mU1yAx1NP4x5BXzHl5jfuNPRtx3csuE4N5vvpVMSAHw8AulDkwYEYYBjpjcfBNEi4E1MSMsG/qySeLMSNQ3JIlYgwSi3PppWJ0PkV3c1WM4YwAZjgVdjrGWmEY+Pd8wQXifJBYnJ12Et91lxj3CLcbu+buuacY36RgzBgGjmrulGVZExVfk5ZljVkGQgNhIwNhlIFQbCA0EK7TQJj8duHQocNRh3xNWpY1ZhkIDYSNDIRRBkKxgdBAaCB06NDhaEK+Ji3LGrMMhAbCRgbCKAOh2EBoIDQQOnTocDQhX5OWZY1ZBkIDYSMDYZSBUGwgNBAaCB06dDiakK9Jy7Imq7xwh554QgzhZQ2RPL8oRmkOvf9+ia70XjRyKxJbov4oGrn5Fp0oAlFe4lS47nXXlWgovymoc6AnnxRDJBNVNd+l6k+jMcEPPijRlT6MRm5FYierfx+N3DffLNEQqnrkPvJIiYbye5T/Wzj3XDGFPSrPOkuMuvb++8UokcFal18uPuggMapt7NiJ3PPOE4OmsFEs+AGggp1/77lHvGiRGKMCEIKlb79dfNppYswXg/zhD8WnnioGpWP62HP17rvFmO/554vxhxK4+JOfiM85R4wxY5B4ZHEhGDM69lgxKA7YBpj89rfF2M4U/8zQ+dZbxbjd114rxteZeESxyyj+UN5xR/SUZVkTFV+LlmVNVjl7QHkRjHoDMhAaCA2EMzIQGggbGwgnBITJbxcOHTocdcjXomVZk1XOHlBeBKPegAyEBkID4YwMhAbCxgZCA6FDh/Mv5GvRsqzJKmcPKC+CUW9ABkIDoYFwRgZCA2FjA6GB0KHD+RfytWhZ1mSVsweUF8GoNyADoYHQQDgjA6GBsLGB0EDo0OH8C/latCxrzFq+XAzhhQvlxXcpn0Sj+CbUra8uv4tGbgUM+6kzUCGI7iHOgWHZshIN5cCQg1me+8wzYujmm8VQfo/WW0+M+fIebapWMLv33hL91lviUvaP3nTTEo3rvvNOiS67i1FeIje/RzfcIIaeekpcyhHRgBrohRfE0J13iimQCYpg8AOQAOU1kOCmm8SYAwBJS2ReCMCA7xJuu02MzijNUbiDPDEjrAYuhGFgRoBnXBercf31YrAl/plhgjgz7jdmhDHfeKMY/I8deO+7Twyawjrj7mNGYDyMCrj44x+LH35YjGXHawMPMGaEM2NGGBUAGPSIBxirAWrV6U9ZljVR8bWo2uCvNkjM3pZlrYYMhAZCA2FHBkIDoYFwxvMPCJPfLhw6dDjqkK9FVUJ9yaFGqBO6NnakeTPd2LSqkcktZ0Zi3d7Wp25ESwwta1gZCA2EBsKODIQGQgPhjA2EDh06HGPI16KqQ31dfxvsEwj7D6GuRzuNXQ+Vqr0J+2lPPrelW9bcyEBoIDQQdmQgNBAaCGdsIHTo0OEYQ74WVRMEwlJ1aMK2xNXuX3fAodih7mxZQ8lAaCA0EHZkIDQQGghnbCB06NDhGEO+FlUGws6H2KHubFlDKQeG9dcXT6u4k+Rm6vJntai6rhTfixeXaFyXwFAujD777BKN3MceK9FQDgylnBh99dUlGnr+eTGEShWDrGhKtPHGYuSS4rYXL1gghqrrHhy9zTYlGtf98MMSDaEmRG6+jSq26ERuRctLolFsI7eiONnOFFU9cqsHWLTZZmLkcvvWhx4SA1RQyGI5rrpKjOcbZT1KZFTbt9wiBntgVKA4LBaA4aKLxDgVtn9Elf+zn4lzWgYCgR5xXRjIhymAtC++WAx4xi6jAMLvfEeMe4T7C14CeuEuYJCY4NSUGJ0xDIAZvu+BMQxsk4u/yHiusBp42nFm3G48sZgRvjoCaWvnKcuyJiq+RFXDA2FUfRQtEDo0IU7b1j6bqYdiIz40qg/VHyxrbpTXtQZClYHQQDij6gEWGQgNhAbCtQsIk98uHDp0OOqQL1HV8EDY9XNbS62mT36qjvrpU7qds+7c9VDnc93ZsoZSXtcaCFUGQgPhjKoHWGQgNBAaCA2EDh067DPkS1Q1h0DYM+yqpk/s3JbY5/nrc9Y9ux7qfK47W9ZQyutaA6HKQGggnFH1AIsMhAZCA6GB0KFDh32GfImqEupLDjWaTgkNYZs6r2+0xLBRW7d+2vv53Anbrm5Zq6m8rjUQqgyEBsIZVQ+wyEBoIDQQGggdOnTYZ8iXqKr+bRC/E+aartgpttRHu6rz+q5bopr22C221J3j0SZEh04jQrRY1hxrww3FELfoVO20kxh65RUxdNRR4ubfQ0dPPFGiIbzokfvssyV6oKL/178u0WVXMTbtQ+6rr5ZoaOutxcgdCDagipZFe+whhl5+WQzlW7BW26g+EA1sQe6LL5Zo3CMUn8hdsaJED3SPXnutREO4R1AFz6IDDxRD774r5h6V2IbxhBPEwCfU06iJUU9jO1OU18A2nOq448Q4M/gBp8IuusccI8aMkIsJwiAxrCSmAB95pBgbh2KtkHvtteJjjxWDiDDmfIKnnCIGTWEY4NIjjhDjKyssDnLxZRhmBA7HmDEqHMWocLsBoniuDj9cjGXHjLCwwEU8wHq7pyzLmqj4mrQsa7IyEEYZCKMMhFEGQgOhgXDGGBWOriVAmPx24dChw1GHfE1aljVZGQijDIRRBsIoA6GB0EA4Y4wKRw2EDh067BXyNTkhoUiY9n+Wac1bGQijDIRRBsIoA6GB0EA4Y4wKRw2EDh067BXyNWlZ1mRlIIwyEEYZCKMMhAZCA+GMMSocNRA6dOiwV8jXpGVZk9V++4mhHBjy3SArYDgzGtUIcpcvL9EABlSbyOWYBwGG118v0VAODDk87767GOKYVaivoDw3h+fqHsmOneic35SctPntQHpToIqWD4nObwq3YFXltMwxq049VQxVN0UefoIZymv8u0KJDCJCef3DH4oPO0yc71+K8vquu8Qor7G9Z86HuNChh4qxFSroAvvGIhe3ATSFYWCrX8wIFwJ7YOkw30MOEV9/vRgzwsIiF3wITMWXJccfL8aDhCngluHMBx8sxiDR+cEHxbgp+CYJu7likPjDgRnldwE7suJ2Y0Z6U6Ysy5qo+Na0LGuyMhBGGQgNhI04ZpWB0EBoIFyrgTD57cKhQ4ejDvnWtCxrsjIQRhkIDYSNOGaVgdBAaCA0EDp06HD1Qr41LcuarAyEUQZCA2EjjlllIDQQGggNhA4dOly9kG9Ny7ImKwNhlIHQQNiIY1YZCA2EBkIDoUOHDlcv5FvTsqwxCzsaQhUhnBqNNzuK/qefLtE5MHz4ofj558VlZ3EODM88Ix4IGHL94Q9izBedcTRX2bOIU33yiZjnSoVT5UcHUq9TXRHNbWP3UpcVahHArLruv6sfiiaY7aDeUl3ei+a/hfXU5S/Rv/lNiX7uOXH5ghrl9T33iEFxKK8fflj86KPivLwGTE5NiVHlo3BHeY3NIfGPEMNA7g47iHfeWYzNi9H5v/038aJF4q99TYyje+6ZeZddxLjubruJkYvr7rWX+CtfES9eLN5xR/Ff/ZUYiwNjkLvuKl62TPzAA+Jf/lIMWsYziT/BjzwifvxxMc780ENiHMVXVjgzRoXn6mc/E2OCP/2pWKcwZVnWRDX7ju+m6f9vOjF7W5a1GjIQ9i8DYaJepzIQGghX2UBoIFzzgDD57cKhQ4ejDsNLvosS6ksONarqhC6NHWnejLq2o7FO79pSf4jq2ti041Dd0qjpb1kDyEDYvwyEiXqdykBoIFxlA6GB0EDo0KHDEIaXfBd1qK/rb4N9AmH/Ya1V1cUctLR9iOraWKr2PLSsgWUg7F8GwkS9TmUgNBCusoHQQGggdOjQYQjDS76L1nAgbD7XjXVL1w9RXRtLe3tH+VHL6i0DYf8yECbqdSoDoYFwlQ2EBkIDoUOHDkMYXvJdNHEgbP63DutD8XPd0vVDVNfG0t7eUX7UsvrRW2pRtaOjCCXitIpFsAqdS/ljNOrpUk6PxtHNNxdjs8BSLoz+/e9LdCl/Vr8ZvfHGJRpF/xe/WKLLBuqyPHq77Ur03XeLsc0kyjxU5hjVa69lBj1usYW4lBOjsccs7i+uSyzfWIy9ErEl6W9/K/7LX8R4No46qkQ/9ZS4ukdL1eerhUtL+VQtu6qiukZp+hmYq2+OrvanxTCkc7nlFvG114rxrKCsx8pidR57TIx6GvSIOh67fa5YIf6XfxG/+qoYR//5nzPjkQXx48zIzYeR5+IohoGj+C4BnetJRWNG+ZhxZlw3H9U//ZMYF8KZ//VfxRgkToUZ4cw4ikEOlAtjGBgzjuZLl555yrKsiaqkGh4Io+qjaIE6HZpuCOtDbY1dP0R1bWzacahpbA6hxbIGlYHQQGggNBAaCHUYOAq6QOd6UtEGwv5zYQxjlECY/Hbh0KHDUYcr68J2DQ+EXT+3tUBNh05NUjd2PiTtnc/1oa6X7tpYq+26lrXaMhAaCA2EBkIDoQ4DR0EX6FxPKtpA2H8ujGEYCB06XEfDlXVhu+YQCHuGtZoOnZqka2MUOjSf60OxT6OujbXQrc8sy0pkIDQQGggNhAZCHQaOgi7QuZ5UtIGw/1wYwzAQOnS4joYr68J2JdSXHGr0eZHZb1ira4emse1sdXt9KD8zVJ8wCS1rNWQgNBAaCA2EBkIdBo6CLtC5nlS0gbD/XBjDMBA6dLiOhivrwnbVvw3id8JcnxeZrS31Uahrh05j/4c69UzsED9EdXpGdT0UMmYOocWyBhM2wCvlmeg//7lEo+iv9vN8TH1ENLYkLeW30TfcUKJLuVG9OBrcAl5CHV/Ki9HYDhATPPNMcSnHZV6/iMvL0WC8jz8Wl3KdWkAFrAUvWSJef31xKe9Ef+ELJRqn2morcdlCDW7B/eX0Ba3BeKW8Ef2lL5XoUj6OvuKKEo0ZxT+In6ni/7PVCvx76m6ue6n1WwnshnjuuWIQbykfqRep9cnZrohRyKI0/8d/FKOuRS5K5Bw2YJz5//5fMTrnRT8K95xMkIv55lMAeefXxYVgdM7HjOviluHM6JzPCLlvvCFGLm43blk9x2icKgfCfAr5WuEo7hHGnF8ovwt5ZwxDV2PKsqyJqliWNVkZCA2EBkID4UrjzKjU0RlnRm4OZvl1DYTRBsLo/C7knTEMXY2p9LcLhw4djjoslmVNVgZCA6GB0EC40jgzKnV0xpmRm4NZfl0DYbSBMDq/C3lnDENXIy9VHTp0OOqwrBlCgTHt/w7Tmj8yEBoIDYQGwpXGmVGpozPOjNwczPLrGgijDYTR+V3IO2MYuhp5qerQocNRh8WyrMnKQGggNBAaCFcaZ0aljs44M3JzMMuvayCMNhBG53ch74xh6GrkpapDhw5HHRbLsiYtIZN33inRf/yjGPtqvvuueI89xGUTMd7dOPMGG4hxtCrc31cfI0bRr1tHYoLvvSfecktxKftHb7ttiX5Md3B84gnxJZeIS7la/MUi/pK6vKt+XvyFIt5QvHCh+K23xGWB+OmnxTwzN9JcEX3hhSUaNHX22SX66qvFYC08hDvuWKL5rUS5PRq3DMBfynvibYp4a7XOFxVytZ0pFufVaEy/eoBlM1sWsqhcBzoKfsC/OpTIyAUDoHN+FM4xJj9zPqrf6BbD6Iz5vqz7TOJozUgJL+XcgvniVJhvfnSgzvlaDXSqPHeg1UAuFie/g/mZYeTizJgvhqHznbIsa6IqlmVNWgZCA6GB0EDYCyfyozCGgQvlZ85HleME5msg7P9Uee5Aq4FcLE5+B/Mzw8gdDgiT3y4cOnQ46rBYljVpGQgNhAZCA2EvnMiPwhgGLpSfOR9VjhOYr4Gw/1PluQOtBnKxOPkdzM8MI9dA6NDhWhsWy7ImLQOhgdBAaCDshRP5URjDwIXyM+ejynEC8zUQ9n+qPHeg1UAuFie/g/mZYeQaCB06XGvDYlnWpGUgNBAaCA2EvXAiPwpjGLhQfuZ8VDlOYL4Gwv5PlecOtBrIxeLkdzA/M4xcA6FDh2ttWCzLmrR+H416+tNPM3/4obiUD6KBi2Va/NvfZgYDsMrfQV1k98s33yzRDzwgLuX1aFT5V10lxqiwySowppQL1JdFH3xwiS7lZLEuTik3RD//fInGNqq77y4u5QfRp55aorFx6KablmhcCFQDli7lEbVSa1kcvf/+Jfq668SlvKJ+W/2HaNSEn3wiJuLqM1nKf6rPjsb2raWcGf3++yW6LBTj25DtthNXki8aWLnmRhEM53V8fhQriwIalTpwGWfGqQCxOJqjCKb///6fGFPAhQCEOUvnq4Gj+SDrsyWub3FyKlwXR3FTMF/kYnHqgSXGhfBs4ELYVrSeYzQeBhzFmdEZQIgHOL3QlGVZExVfkqp9z9o3MXtblrVaMhAaCA2EBsIKgQyE0TiaD7I+W+L6FienwnVx1EA4BBAmv104dOhw1CFfkqqE+pJDjfD/VtW1sSPNm1Hep24PfaUdHRBCbZ0ta3QyEBoIDYQGwgqBDITROJoPsj5b4voWJ6fCdXHUQGggdOhw7Qz5klR1qK/rb4N9AmH/Ya2kf9fPSf+mpW7stLOpvbNlzbkMhAZCA6GBsEIgA2E0juaDrM+WuL7FyalwXRw1EBoIHTpcO0O+JFVrJhC2JdbtsSVJT1rqQ5Y15zIQGggNhAbCCoEMhNE4mg+yPlvi+hYnp8J1cdRAaCB06HDtDPmSVBkI60OWNcfCxqHclVH5AfU0KopSno5GQVUBA2jq02hU+aX8Ti2dzzyzRJ9+uvh3vxODLj7+uESXckj0VluVaGykCQb405/E0HQqXAhHH3mkRJedxUcdJYawFWrZS4wLbb11iX7hBXGll6NxKtLj9uIFC8RQBXX7RQPbAO3cv3RbNbcGFWGdMSNs34qjzz5boiEsLIXCHWVuTmL/+I9iVMz4R5iX1xgGLoTc/FSYAoaRXxfsgc64LnL/z/8R33uvGN+d4Luia68V33ST+Mc/Fv/iF2I8dvfcI/7Rj8S33pr5ttvEt9wixozwz/vRR8VPPil+6ikx/pk9/LAYi4Mz//KX4vPPF2P6P/mJ+OabxZj+/feL77pLPDUlxpnvu098551i3NBrromesixrouJrUTU8EEbVR9ECtaW3JdbtXbPybmipD1nWHMtAaCBsZCA0EM7aQGggnE9AmPx24dChw1GHfC2qhgfCrp/bWqC29LbEur1pwaFhQsuaYxkIDYSNDIQGwlkbCA2EBkKHDh2OJeRrUTWHQNgzrNXWvy2xbo8pUNduTQjFo5Y1xzIQGggbGQgNhLM2EBoIDYQOHTocS8jXoiqhvuRQo+kKtJKwVtK/6+c++w8ZWtYcy0BoIGxkIDQQztpAaCA0EDp06HAsIV+Lqvq3QfxOmGu6QqnYUh+F6g5I76huqdubz10b2z7njZY1N3r8cXGlt9Ui1BuVBBhQiz/3XIkGid19d4mWf1vT09g9DrrkEjFyn3iiROO6oItSlkVjE86yp3j99cUgT1RulWQzTIy5bFHE6U3Jb+i224pxIZInd3PNrosd/som4gsvFOO6y5eXaOj228XQe++JyxfV5a1oXPfXvy7RpRwVjcIVuTnxbrmlGLn8ruSHPxRffbX4yivF118vRvH94INigMqyZWI8lLj9P/uZGAyAC+FfLK6LvxS/+pUYoILNbTFIFP133CEGxmAlL79cfN55YtxvnAoGH+KmwNhUFxiDlcSMsPHxRReJv/Md8WWXiQGTuEc4Ch7GmLE4uAuYArANqIk/wXjqQJ44iucKyJezdOopy7ImKrzZLcsat3J+yBnAQGggbGQgNBAaCLvbQLg2AGHy24VDhw5HHfLVblnWmJXzQ84ABkIDYSMDoYHQQNjdBkIDoUOHDtOQr/YJCS/raf8nmtb8Uc4POQMYCA2EjQyEBkIDYXcbCA2EDh06TEO+2i3LGrNyfsgZwEBoIGxkIDQQGgi720BoIHTo0GEa8tVuWdZkhfcvVBXQB0ej6kUxxtzt1LpxKK6bb+FYyutqEUoI6MADxRDqHGjffcWYfi8CfFUtqqhV1hn0iNwXXxRXEkDCsTffFEM77igeaL6HHSbeaScxIXY9MbYwxHWxJyWEPQuhDz8UV/qdWlR9d3B6NCYIESax/+ENN4hxFGU9sO3oo8VY95NPFqOA/ru/E2NDyxtvFIN5dM9GdgaJnXKKGJ3BHj/4gRj/JkEmGDOwDWSCU333u2IsOy70ve+J8S0UHjvcUDzQQD6Q57nnik89VYw/sldcIcaGyzgKmsJ3NpgRvrPAjLCNKpgWdwEGHuMe/fSnYhzFOuOrI/xJwrchevenLMuaqPiatCxrsjIQRqFihAyE/c/XQBhlIDQQGgjXNCBMfrtw6NDhqEO+Ji3LmqwMhFGoGCEDYf/zNRBGGQgNhAZCA6FDhw4b8zVpWdZkZSCMQsUIGQj7n6+BMMpAaCA0EBoIHTp02JivScuyJisDYRQqRshA2P98DYRRBkIDoYHQQOjQocPGfE1aljVZYYc/FN8sZFXY4g4iEKrwsoaqbUWXROcQu2CBuJeEAaoxC5htsUWJhghIuiXpZ+sRjXXOAXj77cXIJVxto1YQRS7HvId4v/3EILGnnxZXeica163ub6aKeA9UCy0fc0yJ5gQXqktnO9zGopw899xTjAnypkBgADAeyOTWW8U4is0hwWmo43Gqa3WfSeSCtTDmiy8WY+/T444TH3usGA8Wpo8/KyAE4AQmiBnBoCmAGY6CtLHsgEng4l13ic88UwwwA3r94hdifB2AMYO1ALGYPr4qw56reJDOOUeMXOx9in1x8b3DWWeJ8RBe+v+3c7ahtlX1Hp7IRS5SXgmJS4SEiPihzLplepI4aPiWmW9p5dsxTY9vqXmztLTyhctNpRffTXOrpZmGmRiZmMgp7GQih4OIcEXicrlEH8QPfYiLnCtn7TP3+D1jrbH2PnvvtbZnPw8/ZP3HHGPNueZc+8zxzCXjaxHsF6cdTxZwGHiUgC9hSuyMiEwV3haTUh3rsLeILB6FUCGcO2aFsEAhVAgVwh1YCMv5paWl5YRL3haTRofGph7ckYc2Dshxs6B9VOeh7UNbylJkhaIQKoRzx6wQFiiECqFCqBBaWlouR8nbYjLoUPbvR40d21UO1i5ryg7b8XqhuxNZESiECuHcMSuEBQqhQqgQKoSWlpbLUfK2mAw6lP37UWPHdpWDtcuavsOonnU7hpQd6s4iKxGFUCGcO2aFsEAhVAgVQoXQ0tJyOUreFpNBh7J/P2rs2K5ysHZZ03cY1bNux5CyQ91ZZIWwORNwAp1gzUJQTaAxcQ9DgBJUjve5MphCgOefjwDMoLbN2GfhxD2FYbfdImDz5gjASoqgMs8ATnvQQZG2pXO/74pU1+i8Mu1lRdvHXBn+jWWqc7W+DBZHBNV+ny2Dg8RYnMk334y85z0RwP3StF/JBPw7wtOBU06JwC6wnueJJ0Ywy8cEGtNrLMP4rW9FrrwyAjPBXBySA6vBOpPYisOAt0D5sBUiimUnISrtRSlxVPhHB1sxFp4G58HJwRXEMqoQb8jkDTdEYLxwHuwIb4X94oJefHEES7BCy3Fy4PD4PrcfB3zmMxEY/kUXRbAjrNeKrwoWaMU//fnOMyIyVXDTBIsXwsbEoG4BfYdRPev2ekj9QmSloRDOoRAqhAqhQqgQrkIhLGeZlpaWEy5x0wSDDmX/ftTYsd24H+jqFtB3GNWzbh86ZPC67iyyQlAI51AIFUKFUCFUCBVCS0vLSZa4aYJBh7J/P2rs2K5ysHZZ03cY1bNuHzpk8LruLLJCUAjnUAgVQoVQIVQIFUJLS8tJlrhpgkaHxqYeTAbaZU3ZYTGvB+XY3YlMC4VwDoVQIVQIFUKFUCG0tLScZImbJih71mHvinoyULbUWwE6jJpgDG2vy3qgyAphIUK4JpNS1/8xDKBcJXvvHcHY9jKbO+8cwdhnn+3KdB+JYHKCse39Qicw9qGHujIVfymDsTzP3TGZuEbjxoLW2PbnXdh3g/w1E2zcGAG4RqA99sgjI2DDhgg47rgIzlX1fY4lZ7vumTLjxiZf+lIE0/qvfCWCaf3ll0dy7UQqARwPOoF1JtEZ64hC6uClOAz4IVQEY6EEOBtY7BQPPHBy4C0QYHSGS0Pq8JQC5omFQ3GQeHIGx4M+YXXTSy6JQMxw6rDqJq4RTAzP1U44IYKtp50WwXfj+OMjOBvYL75mePyxbl0EO8LTEHyRcCZh6ZddFsmxMyIyVXhbFJGJs5BJv0KoEG5j3H4VwsbYRCFUCBXCaQth+YODpaXlhEveFkVk4ixk0q8QKoTbGLdfhbAxNlEIFUKFUCG0tFzFJW+LUwL37i3+752ymljIpF8hVAi3MW6/CmFjbKIQKoQKoUJoabmKS94WRWTiLGTSrxAqhNsYt1+FsDE2UQgVQoVQIbS0XMUlb4siMnFeLYOJLPt2/8gE1az3uMwfMgGXncxlGDE5AZs2RQAmvfiAr73WlQFY0m/M2P0i3/xmBLz6aqTr/l6mvbznk092ZQCWysTYp57qyoD2ftvLmWKNxsWM7XaNVGMPLYOZOeD3ik80WrzxRuQtBc60lhW96aZIt0+m2xTB8p5XXBHBpB9WgzkxZANGBDGDemECjfU8ITkzMxG8FdaobK8jCm+5/fYF5L77IlgL9JFHIrgqWCm07aU47fgnCWPxDwecFltx9fEPFvaLpwOwx0svjeDLgCVncTbwZAFnEh8QFxRvhaPCVwWLf8IADz44cvLJkX/7twi+Zh/9aATf9gMPjFx3XZkZEZkquIeKyORRCBXCWdr7rcQsUAhLMENWCBVChXA2K1UIG79dWFpaLneJe6iITB6FUCGcpb3fSswChbAEM2SFUCFUCGejEFpaWlYl7qEiMnkUQoVwlvZ+KzELFMISzJAVQoVQIZyNQmhpaVmVuIeKyORRCBXCWdr7rcQsUAhLMENWCBVChXA2CqGlpWVV4h4qIhNn90xaTRtM+rm5ydtk7OYyGDtumc3tH7vnnhGMZW8S++127spU0g5CcrDfBx/sylS8UQZj2TfBKow45rYAH3BABHDJ2QQLK4Jddol0O2VyWVGMbV9fXqNzzolg4g4/RGcsO4kVWr/85cjhh0ewKuPatRFMzT/4wcixx0Y+9rEI5vHHHBM577zISSdF8PEhDDCTM5vrauKpDOQKYoYzidUvYWLQJ1wjdIby4RPhrdpjEYzFycG6mt/+duSssyI4ObiCOFf4muGpxBlnRHBR8GXAWLwzXBrvjDVmcWKx1C3+cPJMzojIVOFNMvndX37XCHuLyPagELbYfqlbzFiFUCFUCBXCIWMRhXDphLDx24WlpeVyl7xJJg3ra2zqGTohQeOAHDfL0Pa+kW+R7XMDckjZPrRFZOIohC22X+oWM1YhVAgVQoVwyFhEIVQILS13iJI3yWRgfUN/G5ynEM6/rKmnMWXLqOFDR+FFT90iMnEUwhbbL3WLGasQKoQKoUI4ZCyiECqElpY7RMmbZPI2FcL+v2ULGke1iEwchbDF9kvdYsYqhAqhQqgQDhmLKIQKoaXlDlHyJplMXQj7/44qa9CtfF0PqVtEpszTT0fG8K5INQk+KrOpzFZNmKMaCxYkV0dn7i+DsX/4Q1cGoPNzz3Vluu7wTJJLZbbBJBC8+GKk2yOCSRHgMpvdFzI/ygSVAWLZ2P+O7NaVefjhSMX/lcF5/sUvujLgtNMiGIt35mCQ5tnmwx+OgGop1ABywWPGuovwY+Szn42sXx857rgIlOBzn4tgLn7EERGsUQkDxGwb73z11RFsxSwffoixcC0YEdbVhCDBh9EZbwV7xDqiOBv4+FhmE+tbXn99BEu/4irg7xnBYWArlveE4+Hk4Cp84xsRnHao5iWXRODS+Ofs3HMjF10UOf/8CJa6hfA/+mgEfxo47fhLwdnIsTMiMlV410wWL4Rxz622ogUMOvTd6hKU3doveuoWkSmjEJags0KoECqECqFCuEMKYeO3C0tLy+UueddMFi+EQ1+PagF9h9lbdtU4eAHqnTaG1C0iU0YhLEFnhVAhVAgVQoVQIbS0tFzaknfNZAmFcGxZ03eYvWVXjYMXoGwfvG4MqVtEpoxCWILOCqFCqBAqhAqhQmhpabm0Je+aScP6Gpt6ts4N5lvWDO3QNw7d2lXts7f76nVdiqwIFMISdFYIFUKFUCFUCBVCS0vLpS1510zq3wbxO2GbrXODkS31VjC0Q98Yt/OtoEPZDWVP0VFkSlA2UmMw38A3uD0JxoKWGMveTVbI2MqW15XBCo6gbZ7Lxz33RLq9I7vuGum2RB56KFLxjzI4V9zvvpnuxUxAw98rk08HsJVjk733jow5ZrKhDMZyv2sy+TSEb3zVVRFoDGb5mHxD+TDrxUqSWCvy6KMj110X2X//yDXXRN75zggO8t3vjsDxPvCBCCTnwAMjP/xhBMeMsRdeGIFs4NR96EMRHNXHPx5ZsyaCznhagIP80Y8ip54aue22CIzoq1+N4HLDiLCOKIwXvgQBxuKuhx0WWbcugkcYkEl8kXCQ2O+RR0bw7AQPC6D0+F7hiQaOCmsKp/HOiMhU4W1RRCaMQtgAYxXCRCGcg/tVCBVChfBtJYSN3y4sLS2Xu+RtUUQmjELYAGMVwkQhnIP7VQgVQoVQIbS0tJxfydvilMCdfcsCJ40ib2MUwgYYqxAmCuEc3K9CqBAqhAqhpaXl/EreFkVkwiiEDTBWIUwUwjm4X4VQIVQIFUJLS8v5lbwtisiEgbZVtCb9XA3yvZnu72UwlhNosjET8JjfE9l99wj2+9hjXRmA1RDB3XdHKkJUsF9+3p2xvuVLZTC2vWLnnntGwLPPRrqdMm1RIQv5gMn73x8BbVs+5ZQIaO93McfcHvvMM10ZcPbZEfD88xFOczHbxvQaaydi0g9tg2piuUscJVbOhONh1U0EO8KTJJjY974XwaQfi3BCJ+AAWCoTAoyteCuY2BlnRCBXuAqnnx7BqcNKuPhEkCvsCBqDE4urj6uAD4hjxtfs+OMjWBoUz7dwQfERcMzQcuwIK5SuXRvBmqv444dMnnxyZEE7yks2IyJThbdJEZkwlCuiEM6hEC7gAyYKYYlCqBAqhMM9bXpC2PjtwtLScrlL3iZFZMJQrohCOIdCuIAPmCiEJQqhQqgQDvc0hdDSclWWvE2KyIShXBGFcA6FcAEfMFEISxRChVAhHO5pCqGl5aoseZsUkQlDuSIK4RwK4QI+YKIQliiECqFCONzTFEJLy1VZ8jYpItOmZQicQO+faU6gOTZpm9imTRGACRVo77frXi2DY37wwa4MwFQNYzdu7MoAzL5A9XmPy7ySCdpLg2Ka13Uvl3nlla4MwPp/mG3ymN8XgQIAHvNukZ12iuA8VzJ5Shl8NzC2fY3ax1ztF9for2Ww3yee6Mp0J50UwZcDfxtQgosvjhxySAR+iB1hHn/iiRHMtnH5oQRQr1zCkX8qF10UwVthXU1M62EmWJMTOoHDwH5xVFigFa51yy2Rm2+O4OPjna+9NnLHHRHoIt4ZnWsVbwT/9mG91ltvjeDE4q0wFou7YkdYzvSuuyK4Rngr/NXh1LV39MADEXwiJFfcnRGRqcJbbHL1T69uhL1FZClQCOdQCEsUwpJqvwqhQqgQbs3bUwgbv11YWloud8lbbNKwvsamHtyChzYOyHFz1H3Klp66vXyHcmDfXm7qy3q4yORRCOdQCEsUwpJqvwqhQqgQbo1CaGlpucCSt9hkYH1DfxucpxDOv6xp959nWb4Y1Qev61JkkiiEcyiEJQphSbVfhVAhVAi3RiG0tLRcYMlbbLKihBC0360v8aLsVvcRWQkohHMohCUKYUm1X4VQIVQIt0YhtLS0XGDJW2yiEIpMmjVrIqCaBJ9XBoYwmPv2vPhiVwZgGoCxFIZkv/0ioDrmL5bBjBG89FIEtI95w4auDNhrrwjGcvnWPGYsygg2b45A2jHNA9W5+noZHCTGYjnTduduS2bXyPr1kXe8I9LtEbnnnki3b6Z7MxNw2di9I/gI3NEBmQU9SQHQNnyxMJHFQotY3xJbc9bLJUmhQJddFml3xkwdXyz8XWHsmWdG2gul4uPj5MBp8QCgXHLzrcDTcHLgltCYc86JwOKwQumdd0ZwVJAraAze6pe/jODpwP77R044IYKtBx0UwZMFdP7UpyK4CjfdFMGzg9tvj2AslmCF8eILjIcjuKBYcvbYYyM4VzDtvKAzIjJVeFtMFi+EJfVWtNTMf3jZs9zUv57Pi8FrvIPIRFEISxRChbCHO1IIFUKFcAcSwsZvF5aWlstd8raYLF4Ih74e1dIG/Rvl0Nd149BNo1pEJoRCWKIQKoQ93JFCqBAqhAqhpaXlUpS8LSZLKIRjy7G0h48q6xf966GbRrWITAiFsEQhVAh7uCOFUCFUCBVCS0vLpSh5W0wa1tfY1INJSLusafefZ1m/6Muypd5aliKTQyEsUQgVwh7uSCFUCBVChdDS0nIpSt4Wk/q3QfxO2KaehJQt9daacjJQb2qUfUvfXvcf2lK3iyw3/yhTfhG31EuDrsk0lxVtWxz2i23c716ZXGYT++XEncQxY9tPfxoBe+8dwX6rseszrf0+/HCkYiHXiKLyamMZ1Ucf7crAtSA5GNu+vlgatOsuLjPuGsUxY1v7XGGlTMBzRV4qg8/7+ONdGbDPPhGMrfb7ycgXvhCBP1x+eeT00yPr1kW+850IHO/ooyPQNow97LAIljPFLB/L12LSj49w1FGRU06JnHtu5MILI3grjIU/QBePOSaCzvBDfKKvf70VdMZCqbgKRxwRweW+/vrI+edHoEDQRSyjCg9H4OH4+FhUFraMq49HONfmwwI4Hjpjv6eeGsHTL6zmCnnGFxhPKPFXllo+IyJThfdUEZk4C5ENhVAh3Eb7+iqEJdV+t3qgQqgQKoQrRggbv11YWloud8l7qohMnIXIhkKoEG6jfX0VwpJqv1s9UCFUCBVChdDS0nLFCCHu3Vv8nzZlNbEQ2VAIFcJttK+vQlhS7XerByqECqFCqBBaWlquGCEUWc0sRDYUQoVwG+3rqxCWVPvd6oEKoUKoECqElpaWCqHICuBvZXBLfeaZSLdTpimElSAFe+wRAdUEGoSoYNuDD0bAkUdGwL33RipawvDkk12ZitYx8/O+L7LvvhFQLQ0KNpbBMbevEWb1gMdMWt8Nfq+Ss8+OgHH7bV2j9lK3C7tG+0SgWuCFFyIEs3wo3/e/H4EgoTMW4cRWzPIxccdngD9gWn/ccRHsF9qGBS1vvTUCA4TjQZCwFXbRNk/44QUXRLDCMk7Ombky6vHHR+BLWAzzpJMiWBgWVgPDh7ViIU18Xqz2eeCBEfzjjsuNZUVvuCGCFTtx9fGJIHUYC2uFpeMhxec/H/nEJyLofMghkUMPjUAm8zs5IyJThbdFEZk4CuEcCmGJQljC/SqECqFCuAMJYeO3C0tLy+UueVsUkYmjEM6hEJYohCXcr0KoECqECqGlpeVSlLwtisjEUQjnUAhLFMIS7lchVAgVQoXQ0tJyKUreFkVk4iiEcyiEJQphCferECqECqFCaGlpuRQlb4siMnFaE3dOghNML0F7bNe9XAb7RVeswwfaVoOl5rCjyqYOzrQMgeb53shZZ0XASy9Fuu6Lmf8tg2N+5ZWuDGhflPa5wnQL+33++a4MuOaaCHjqqQjA9cV+K4s7NPNaGYx99tmuTLdvBI4Dqu/GUWWwjCr2275GWKORs3xsxnwak/5LLolgAo3FMGFTWO7ya1+LfPrTEVzgtsVBJzAXh/FjTU7YBfYL14Iv4a8dK6NiyUqcZ5wriBmM95ZbIpdeGsGZvOOOCOwR+8Wpy8Uw+ezgu9+NoPNVV0XwZ4blPfEB8beBpwNYJhinHUd1332Rm2+OYL933hnBVozFmcTXDGNxVHkmZ0RkqvA2mZz1H2c1wt4isl0ohArhLAphSfXdUAgVwm1RCHc4IWz8dmFpabncJW+TScP6Gpt6cIMe2jggxwWjOowaW7f3LdjUv+hhvxHHnIN4hNl3lnpr31I21ptkNaAQKoSzKIQl1XdDIVQIt0UhVAgtLS2XruRtMhlY39DfBucphPMvRzG4udeN839dDx9Qt9ctA9pHPvQIB+2NllGv61J2eBRChXAWhbCk+m4ohArhtiiECqGlpeXSlbxNJlMXwr5P2XnUwMW31y0DGkc+9AiHtjQ6jO0pOzYKoUI4i0JYUn03FEKFcFsUQoXQ0tJy6UreJhOFcEDjyIce4dCWRoexPWUV8dBDEYBF+0AlDDFxx90ZPP545K03K9MWhkquDs+8XgZjKQz7Rdr7rYQh2HPPCNi4MQIw28R+29eovdzl5s0RgGuE/VZSFxJ72WVdGYxtn6u99opg7HPPdWW6/SM33RTB2A0bujJg7doI2LQp0nWfLPODH3RlsN/qGp1VBmLS/fjHERgRJu4/+Unkxhsj0Im77oqgM9YvhSDBAbACLw4SfyoPPxy5NlfsxGqfeLKCpSMhV/BDeEtbY7DMJnYEYcBbXXllBFtxVOiMhzQwQHSG8OPj4yDxV4cT275G+AjYEcbinc85JwITQ/CwAF8GOB4eFuBc3X57BH9IOEhcX1yjlNgZEZkquP+CxQthSb0VLTV9n7LzqIGNdtC3Z8dWz7qx34QXPaN61i3x7lU3WV1UE9lAISxpS45CWNI+VwqhQqgQKoTTFcLGbxeWlpbLXfIGnCxeCIe+HtUC0KEvRw1cfHvdMmDUBxl1hPMpy5bGe8qqo5rIBgphSVtyFMKS9rlSCBVChVAhVAgtLVdtyRtwsoRCOLaswf2979+/AItvr1sGoL08EjC029CybBnbU1YR1UQ2UAhL2pKjEJa0z5VCqBAqhAqhQmhpuWpL3oCThvU1NvVsaXoOyppG/wW9HrWjur1uGTDqSEa1Dy3RMup1XcrqoprIBgphSVtyFMKS9rlSCBVChVAhVAgtLVdtyRtwUv82iN8J22ypxKZsqbeWDN2K4QOK7cPb+xZsqhvRMmgctPfv1rfUjYP2oa/Lxnps3bNukdVCNXG/sQyEAbPexx6LQBiw4t24/T5cpi0MfC+wawRjKYTdVWXQme/crcuAezLgLxnwQua5yNouwrfamPlyJtYvhXh33SuZNt/LrM8ke2a6/8mcknkm850yu+/elcEanN1OmTURTC+77t7Musg/d2Uwre0+EsFs8+mnI3grLO3bnX9+BJ52990RrCOKFSwfeCCC6TUWmYVMn3Za5Ne/jsAf1qZMH3RQ5PjjIwcfHDnggMgJJ0QOOSSCpW8vuCBy5pkRPLI644zI6adHYDXrtq4m2ufWWyPQcpgJVt3EWGzFWBgRlB4XBV93/IsM5VuzJoJ/oPFk4Wc/i/zxj5E//SmCB1p4ZoMd4Sv6+99HsKNf/SqCFUrxd9U+jPY733ZbmRmR5eet2bUZHRFZSVRiphDOwXdWCBVChXAQhVAhfJsLYeO3C8t9PrVPn7rc5QO79Fnacsu/bOkzzfKticO2jC3P2uW/+swklQKZMiKykqjETCGcg++sECqECuEgCqFCqBDuuKVC2DBAhXCJsiLArG/YxE9kdVCJmUI4B99ZIVQIFcJBFEKFUCHccUuFsGGACuESRURWEpWYKYRz8J0VQoVQIRxEIVQIFcIdt1QIGwaoEC5RRGTKvFbm9de7Mt3Ome4/M69G3tFFUjb23bcrg3nd+vURTCCr+XQ6z/u7CDu/XubNN7sy/LxQgt27SHd/mWoVyjciPHXQtr+WwTKEeOd7c33H7t3NdOdF/qmLrI3stlsEJ+fllyM8OZS6sFZMAvGJMJHrun/PpKbC8XbJdNdkLsj8LZIfv+t+UAb+j7Nx+OGR7l8z3S2ZhzI3ZVIIf/7zCM7OCy9EMM3F9Pr++yPtd8Ysv/3OEAZIzm9/G8HUHAsQ4zB+85sIVkZ98slIe9KPc/XEE5E774zgE0E2cMx//nMEHwGygY+AD4hjbn8iHBUu6FtTzDL4gDjm9kXBlwEmhkcJbanDycF+H3kkgseK6Iwd4Zifzed5+IcSX1EsZotPxLmpMWbCEZEp85pCqBAqhArhmHdWCBVChdAYs1wRkSnzmkKoECqECuGYd1YIFUKF0BizXBGRKfOaQqgQKoQK4Zh3VggVQoXQGLNcEZEp85pCqBAqhArhmHdWCBVChdAYs1wRkSmzIfP3jIgsM5gTX3FFRESWnXp6aoyZZFrMbJhphL1FZLtQCEWmikIoMmXq6akxZpJp0bC+xqYe/O8/QxsH5LhZGn3qsm4py56h74ZNQ7eKLB8KochUUQhFpkw9PTXGTDItBtY39LfBeQrh/MuaRv96U91SlnVju//Q4SLLhEIoMlUUQpEpU05MjTGTT4sVJYRly1C1G9o4n5Z6k8gkUQhFpopCKDJlyompMWbyaaEQioiIiMiyUk5MpxgRGcLihbCk3ooWUHfoW8pN7cb5tGDggL5FRERERJaP0sqmGBEZwuKFcOjrUS2g7lArHPqMam+3NDaJiIiIyLLSK9l0IyJDWEIhHFvW1B1qhdtSgQ49jZbGJhERERFZVkorm2JEZAgN62ts6oFWtcuaRv9RLjeqvW4cNXBoKSIiIiLLRK9k042IDKH+bRC/E7aptaqhZDVbEmzq/wv6TUPH1i31pqFbRZaJ/wdUfTTqexfdBQAAAABJRU5ErkJggg==5f:T51c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIgLz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgICAgICAgIFVBQyBNYW5pZmVzdCBPcHRpb25zICAgICAgICAgICAgIElmIHlvdSB3YW50IHRvIGNoYW5nZSB0aGUgV2luZG93cyBVc2VyIEFjY291bnQgQ29udHJvbCBsZXZlbCByZXBsYWNlIHRoZSAgICAgICAgICAgICAgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbm9kZSB3aXRoIG9uZSBvZiB0aGUgZm9sbG93aW5nLiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iaGlnaGVzdEF2YWlsYWJsZSIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgICAgIFNwZWNpZnlpbmcgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgZWxlbWVudCB3aWxsIGRpc2FibGUgZmlsZSBhbmQgcmVnaXN0cnkgdmlydHVhbGl6YXRpb24uICAgICAgICAgICAgIFJlbW92ZSB0aGlzIGVsZW1lbnQgaWYgeW91ciBhcHBsaWNhdGlvbiByZXF1aXJlcyB0aGlzIHZpcnR1YWxpemF0aW9uIGZvciBiYWNrd2FyZHMgICAgICAgICAgICBjb21wYXRpYmlsaXR5LiAgICAgICAgLS0+ICAgICAgICAgPHJlcXVlc3RlZEV460:T51c,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPjxjb21wYXRpYmlsaXR5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmNvbXBhdGliaWxpdHkudjEiPiAgICA8YXBwbGljYXRpb24+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyBWaXN0YSAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0ie2UyMDExNDU3LTE1NDYtNDNjNS1hNWZlLTAwOGRlZWUzZDNmMH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA3IC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MzUxMzhiOWEtNWQ5Ni00ZmJkLThlMmQtYTI0NDAyMjVmOTNhfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDggLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MWY2NzZjNzYtODBlMS00MjM5LTk1YmItODNkMGY2ZDBkYTc4fSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDEwIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7OGUwZjdhMTItYmZiMy00ZmU4LWI5YTUtNDhmZDUwYTE1YTlhfSI+PC9zdXBwb3J0ZWRPUz4gICAgPC9hcHBsaWNhdGlvbj48L2NvbXBhdGliaWxpdHk+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNybw==61:T514,PiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iIC8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9IiAvPiAgICAgICAgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9IiAvPiAgICA8L2FwcGxpY2F0aW9uPiAgPC9jb21wYXRpYmlsaXR5PiAgICBJbmRpY2F0ZXMgdGhhdCB0aGUgYXBwbGljYXRpb24gaXMgRFBJLWF3YXJlIGFuZCB3aWxsIG5vdCBiZSBhdXRvbWF0aWNhbGx5IHNjYWxlZCBieSBXaW5kb3dzIGF0IGhpZ2hlciAgICAgICBEUElzLiBXaW5kb3dzIFByZXNlbnRhdGlvbiBGb3VuZGF0aW9uIChXUEYpIGFwcGxpY2F0aW9ucyBhcmUgYXV0b21hdGljYWxseSBEUEktYXdhcmUgYW5kIGRvIG5vdCBuZWVkICAgICAgICB0byBvcHQgaW4uIFdpbmRvd3MgRm9ybXMgYXBwbGljYXRpb25zIHRhcmdldGluZyAuTkVUIEZyYW1ld29yayA0LjYgdGhhdCBvcHQgaW50byB0aGlzIHNldHRpbmcsIHNob3VsZCAgICAgICAgYWxzbyBzZXQgdGhlICdFbmFibGVXaW5kb3dzRm9ybXNIaWdoRHBpQXV0b1Jlc2l6aW5nJyBzZXR0aW5nIHRvICd0cnVlJyBpbiB0aGVpciBhcHAuY29uZmlnLiAtLT4gIDxhcHBsaWNhdGlvbiB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICA8d2luZG93c1NldHRpbmdzPiAgICAgIDxkcGlBd2FyZSB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9TTUkvMjAwNS9XaW5kb3dzU2V0dGluZ3MiPnRydWU8L2RwaUF3YXJlPiAgICA8L3dpbmRvd3NTZXR0aW5ncz4gIDwvYXBwbGljYXRpb24+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kbw==62:T874,WzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBTZXR0aW5nIHVwIGd1aSBlbGVtZW50cy5bMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIFBhcnNpbmcgYXJndW1lbnRzOiBbMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIFNldHRpbmcgdXAgbG9jYWxpemVkIHN0cmluZ3MuWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBEZXRlY3RlZCBsYW5ndWFnZSBpcyBlbi1VU1sxMS8zLzIwMjUgMTE6MjU6MDAgUE1dIFtpbmZvcm1hdGlvbl0gTG9hZGluZyBpY29uIGZpbGU6ICVURU1QJVxHYWxheHlJbnN0YWxsZXJfRWd0QnVcaWNvbi5pY29bMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIEluc3RhbGxlciBydW5uaW5nIGFzIHVzZXIgSEFQVUJXUyAtIGVsZXZhdGlvbiBzdGF0dXMgVHJ1ZS4gWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBHZXR0aW5nIGpzb24gcmVtb3RlIGNvbmZpZzogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcR2FsYXh5SW5zdGFsbGVyX0VndEJ1XHJlbW90ZWNvbmZpZy5qc29uWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBHZXR0aW5nIGpzb24gcmVtb3RlIGNvbmZpZyBzdWNjZXNzZnVsWzExLzMvMjAyNSAxMToyNTowMSBQTV0gW2luZm9ybWF0aW9uXSBTZW5kaW5nIGV2ZW50OiB7InR5cGUiOiAiZ2FsYXh5X2Rvd25sb2FkX3N0YXJ0ZWQiLCAiZGF0ZSI6ICIyMDI1LTExLTAzVDIzOjI1OjAxLTA4OjAwIiwgInV1aWQiOiAiNTM1OWU4YTctNmY5NS00NDQyLWEzMjktNWMzNmQwNjIzY2M2IiwgIm1ldGEiOiB7ImNhbXBhaWduIjogeyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Mi4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xNDIuMC4wLjAiLCJ1bmlxdWVfaWQiOiIxNzYyMjEyMjExLVZJek5lbU80YTNYRzBNOGxUZEs0UEE9PSJ9LCJsb2dpbl9wYXJhbWV0ZXJzIjoib3JpZ2luPWh0dHAlM0ElMkYlMkZnYWxheHkyLXNpZ251cC5nb2cucHJvZCUyRmVuJTJGJTNGZW1iZWRkYWJsZSUzRHRydWUmb3JpZ2luX3VzZXJfYWdlbnQ9TW96aWxsYSUyRjUuMCslMjhXaW5kb3dzK05UKzEwLjAlM0IrV2luNjQlM0IreDY0JTI5K0FwcGxlV2ViS2l0JTJGNTM3LjM2KyUyOEtIVE1MJTJDK2xpa2UrR2Vja28lMjkrQ2hyb21lJTJGMTQyLjAuMC4wK1NhZmFyaSUyRjUzNy4zNitFZGclMkYxNDIuMC4wLjAmdW5pcXVlX2lkPTE3NjIyMTIyMTEtVkl6TmVtTzRhM1hHME04bFRkSzRQQSUzRCUzRCJ9fSwgImRhdGEiOiB7ImN1cnJlbnRfdmVyc2lvbiI6ICIiLCAidmVyc2lvbiI6ICIyLjAuOTAuMjMifX1bMTEvMy8yMDI1IDExOjI1OjA2IFBNXSBbaW5mb3JtYXRpb25dIFNlbmQgcmVzdWx0OiBOb0NvbnRlbnRbMTEvMy8yMDI1IDExOjI1OjA2IFBNXSBbaW5mb3JtYXRpb25dIFN0YXJ0aW5nIGNsaWVudCBkb3dubG9hZC4=63:T514,Y3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPi0tPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgIDxhcHBsaWNhdGlvblJlcXVlc3RNaW5pbXVtPiAgICAgICAgPFBlcm1pc3Npb25TZXQgY2xhc3M9IlN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9uU2V0IiB2ZXJzaW9uPSIxIiBVbnJlc3RyaWN0ZWQ9InRydWUiIElEPSJDdXN0b20iIFNhbWVTaXRlPSJzaXRlIiAvPiAgICAgICAgPGRlZmF1bHRBc3NlbWJseVJlcXVlc3QgcGVybWlzc2lvblNldFJlZmVyZW5jZT0iQ3VzdG9tIiAvPiAgICAgIDwvYXBwbGljYXRpb25SZXF1ZXN0TWluaW11bT4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIEEgbGlzdCBvZiB0aGUgV2luZG93cyB2ZXJzaW9ucyB0aGF0IHRoaXMgYXBwbGljYXRpb24gaGFzIGJlZW4gdGVzdGVkIG9uIGFuZCBpcyAgICAgICAgICAgaXMgZGVzaWduZWQgdG8gd29yayB3aXRoLiBVbmNvbW1lbnQgdGhlIGFwcHJvcHJpYXRlIGVsZW1lbnRzIGFuZCBXaW5kb3dzIHdpbGwgICAgICAgICAgICBhdXRvbWF0aWNhbGx5IHNlbGVjdGVkIHRoZSBtb3N0IGNvbXBhdGlibGUgZW52aXJvbm1lbnQuIC0tPiAgICAgICAgV2luZG93cyBWaXN0YSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9IntlMjAxMTQ1Ny0xNTQ2LTQzYzUtYTVmZS0wMDhkZWVlM2QzZjB9IiAvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iIC8+ICAgICAgICBXaW5kb3dzIDggLQ==64:T518,ZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIFZpc3RhIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDcgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InszNTEzOGI5YS01ZDk2LTRmYmQtOGUyZC1hMjQ0MDIyNWY5M2F9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA4LjEgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgMTAgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ij48L3N1cHBvcnRlZE9TPiAgICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29m65:T420,ZXlKc2IyZHBibDl3WVhKaGJXVjBaWEp6SWpvaWIzSnBaMmx1UFdoMGRIQWxNMEVsTWtZbE1rWm5ZV3hoZUhreUxYTnBaMjUxY0M1bmIyY3VjSEp2WkNVeVJtVnVKVEpHSlROR1pXMWlaV1JrWVdKc1pTVXpSSFJ5ZFdVbWIzSnBaMmx1WDNWelpYSmZZV2RsYm5ROVRXOTZhV3hzWVNVeVJqVXVNQ3NsTWpoWGFXNWtiM2R6SzA1VUt6RXdMakFsTTBJclYybHVOalFsTTBJcmVEWTBKVEk1SzBGd2NHeGxWMlZpUzJsMEpUSkdOVE0zTGpNMkt5VXlPRXRJVkUxTUpUSkRLMnhwYTJVclIyVmphMjhsTWprclEyaHliMjFsSlRKR01UUXlMakF1TUM0d0sxTmhabUZ5YVNVeVJqVXpOeTR6Tml0RlpHY2xNa1l4TkRJdU1DNHdMakFtZFc1cGNYVmxYMmxrUFRFM05qSXlNVEl5TVRFdFZrbDZUbVZ0VHpSaE0xaEhNRTA0YkZSa1N6UlFRU1V6UkNVelJDSXNJbU5oYlhCaGFXZHVJanA3SW05eWFXZHBiaUk2SW1oMGRIQTZYQzljTDJkaGJHRjRlVEl0YzJsbmJuVndMbWR2Wnk1d2NtOWtYQzlsYmx3dlAyVnRZbVZrWkdGaWJHVTlkSEoxWlNJc0ltOXlhV2RwYmw5MWMyVnlYMkZuWlc1MElqb2lUVzk2YVd4c1lWd3ZOUzR3SUNoWGFXNWtiM2R6SUU1VUlERXdMakE3SUZkcGJqWTBPeUI0TmpRcElFRndjR3hsVjJWaVMybDBYQzgxTXpjdU16WWdLRXRJVkUxTUxDQnNhV3RsSUVkbFkydHZLU0JEYUhKdmJXVmNMekUwTWk0d0xqQXVNQ0JUWVdaaGNtbGNMelV6Tnk0ek5pQkZaR2RjTHpFME1pNHdMakF1TUNJc0luVnVhWEYxWlY5cFpDSTZJakUzTmpJeU1USXlNVEV0VmtsNlRtVnRUelJoTTFoSE1FMDRiRlJrU3pSUVFUMDlJbjE566:T9c8,SUhEUklEQVR4Z24+cSxIKmhZUSZOPTdUK0NgdEQmI1EiLjJZUCdIXE8yS1NBTXRNY0V7OjdTMV9LMyIjaEIsO1hxYDVHV21Efl9TcyFGXERkZH5ZKkJtLEsoJC19XCxyMiU6dGxeRy58Xm9fKkJTJFY9NFBuNlBWbXRifl52XXNfL1hoSHUuX1V1Py5ed3w6fCgiWFRhLzN6X31lfCoydXd9VS4ldjh3KCU5YSBTcT8+bi5qLV9TeFFPOT5WYyV+eEAsczE1UE9hcDhtIEwsb0l1K2Y7QmFNSC9GLD07S3pDeT5PW3x7Uzw5bj9gYnswfUN+V3YqekhaT1MlTExyOD8+Pz9Bel1tY0R+QUIjW0UsUkYzTTs/aykwI3wsIVlyLHgzfUhiUFFqM283d1ZTNTg0KUMjeisucm9BOHo9NVMpSmgnbVwtNGt6MF13XWI0eF41X0pHWW08UmtnalUvKyRuel1SPEV+Oyo2U2wuLk8wfVV8TDJUTl8oKDBDLyItTDxFZDFkLldcTTJ8JS4uKk8qfFFiViVUSXctWkRvPSJaLk5tSD9UVVB5JiZ5a2lzUSRsRT0zRCJSQ3h4aD43QDxdQzx0c2dtTT57T3pXPG9kfGFBIiF8bm89dSYjcz1XMlQ4R2heRDJSaUVadng/QGFpRX1JaT1nNFAicFhyayMmI2FpVV1UL34/eSVsSEh3XVZGIn1VPCkqMHouW2c+Mn4rYyF6TzFYS1h9STRce34+XnN9RXUwZ1xpI0JZajl0R2N5KSFvWExiUCdNVTZkWC5PI1FCb3JHckYhUXRaUH47cEgoZy88N1ZnentLR2JWV0ROID1yXlNSeSZ9Ln1qQX1zMU8lcF4zMl5GV2xyVlMydE98KGF5KW84J1gnODBhcCJSPzRRdFd3UmlfVkhUL2krR2N6Zn5gKD5uUnxyfHs7JDN7VVo2PjIodzxmblgkKj5XanJTLylgaT1rRWYsd2JkK2ogfGZFKyBuIShgcCI9ei11fTF7IygufT9BPGVPe3hvNWV5IlMvXzw5PHdsPj5ZNj40Kmx3IXdIcFQsajIwSkQiM0NlfTgtckZBLkZ7ci4+WkhtUltDWy1jXlp1bDw2J3FzdCdlKidlcVVOOy9tMGgxI0Y5SiJwOGI3dUpUYCssNDpVZG5jMkczb2FMRDZqQF0+SnVmNCplNTUqaTIuPi9uIkhgNX4pLFpWblJrIUA2dm8hI2A9OkZqI00uSkx8XGsgXXE/QmNtWyM4XnV8andeImR2U3Y1TF1kdDU9bld2Vk83N25RJElRIi1pVlc2IWIwRlBcQVlXWHEoL2BIKWxaQGFFel5tKUNSRD1iLj0/J1Z7PldgLkBRV1lAIlk/KGZiLjluYjlMPSAyYzIpPm43XngyIHYtNFhXQTQmSms5bUsya28zNmA2V3JbfEc2bl5CejFmIjFXb0ssLWZhSFErTyMkaldUYFlRXnY4SzMmdWJwT3Y4S3ZDIiIqNS1pN3U0fV8taDM2U09dRSc0MzA+W0I1N2BwOF5HPV0gQjI0OCAxMEAuY0Y5fGU0dyBHLExXcmV4KERsXlh8enlpfGtvYG5OPFUsLSlZJnZuXnRPM2RsY3B9QSg6fG0oRDMqcDwxeyFvblswJzMjbzN0NywvK2kqWCtudl5VPEJlVD9nOlEhOihGOHJXXDl7dkYnc0w+N2FsY2VlWSdTbC1nW2xicWxhZkhVRzhMSDdbZzNMYiJMUEZOMCpKNkJRL1soLCptWVZGV199MXBMKGIjcyBsbGcpPyE+N18+KWJ9TUA2cTx7KSdKfExLW1tvW10iX1s6PWV3IydaOW1tIDE/fDYvZTx3OngobVFHZGA0WXN5bHw6YkhHb18gb25nPGpCXH08PUZ1ZmNYfiBlayEyeCxfVUZvekRfOnV6ajJxY2U9JmtreW1Nb3UtfnUiWm1lSWg1TUg6V1BlX0R5VmshdiRhZT0pVUtLUXkuRDhKenk5ekUnTTVdI19tcy5FMV5rOG0qfXxCfkBvcDI/YWklZmktYjBjPHZvPmc4NF1hI2B6WSEkZ0AscC8kcUlxTnFWKnlWIHhnR15AMzZHaSpsb1QxO29aInxce1ZtSUgtKTluWV1VdnY1JiFJQDlCJiJzO1d1NUNbeGp3T0c5SmxHfmg5fFM+PVU4T2BRbjs/flk9ZiFXbVgkfVc9TWh4YV1+NiZoYiFkL1J+aEx9Ll43dkE8ZVZcaD4pbVldcWxtNmkiNC9VSFo6Qn0qVF8tbUE/bTJ+Z2dTXlZvZ104Lz8tZUAlMjBibyM4PmYsYngnSURBVCMzeWp+LksoUkZjOX19YkFlWkA4NztvQHllTFNiMXxZKnlCcnhZWV9VVnc/RllrYWdXTSZ8SSwvOVY1WlhSK3pfc2pWWnlaQHktIFJMKHFkZyRfeFJcZ0NuKi4gMT1vQnp+NXBxVCB1IVJVLCtjKHgkN3tcfkpkempVS1lZeVJ8SEQvOUUte280SUVORF04OA==67:Td6c,UE9TVCAvY2xpZW50cy81MjEzODc3NzA5NDM1OTk2Ny9ldmVudHMgSFRUUC8xLjFDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Vc2VyLUFnZW50OiBHT0dXZWJpbnN0YWxsZXIvMi4wLjczNzYuMjg1MjkgKE1pY3Jvc29mdCBXaW5kb3dzIDEwIFBybylIb3N0OiBpbnNpZ2h0cy1jb2xsZWN0b3IuZ29nLmNvbUNvbnRlbnQtTGVuZ3RoOiA3ODZDb25uZWN0aW9uOiBLZWVwLUFsaXZlN2I6MjI6NzQ6Nzk6NzA6NjU6MjI6M2E6MjA6MjI6Njc6NjE6NmM6NjE6Nzg6Nzk6NWY6NjQ6NmY6Nzc6NmU6NmM6NmY6NjE6NjQ6NWY6NzM6NzQ6NjE6NzI6NzQ6NjU6NjQ6MjI6MmM6MjA6MjI6NjQ6NjE6NzQ6NjU6MjI6M2E6MjA6MjI6MzI6MzA6MzI6MzU6MmQ6MzE6MzE6MmQ6MzA6MzM6NTQ6MzI6MzM6M2E6MzI6MzU6M2E6MzA6MzE6MmQ6MzA6Mzg6M2E6MzA6MzA6MjI6MmM6MjA6MjI6NzU6NzU6Njk6NjQ6MjI6M2E6MjA6MjI6MzU6MzM6MzU6Mzk6NjU6Mzg6NjE6Mzc6MmQ6MzY6NjY6Mzk6MzU6MmQ6MzQ6MzQ6MzQ6MzI6MmQ6NjE6MzM6MzI6Mzk6MmQ6MzU6NjM6MzM6MzY6NjQ6MzA6MzY6MzI6MzM6NjM6NjM6MzY6MjI6MmM6MjA6MjI6NmQ6NjU6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6N2I6MjI6NmY6NzI6Njk6Njc6Njk6NmU6MjI6M2E6MjI6Njg6NzQ6NzQ6NzA6M2E6MmY6MmY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MmY6NjU6NmU6MmY6M2Y6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6M2Q6NzQ6NzI6NzU6NjU6MjI6MmM6MjI6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6MjI6M2E6MjI6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MmY6MzU6MmU6MzA6MjA6Mjg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MjA6NGU6NTQ6MjA6MzE6MzA6MmU6MzA6M2I6MjA6NTc6Njk6NmU6MzY6MzQ6M2I6MjA6Nzg6MzY6MzQ6Mjk6MjA6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6Mjg6NGI6NDg6NTQ6NGQ6NGM6MmM6MjA6NmM6Njk6NmI6NjU6MjA6NDc6NjU6NjM6NmI6NmY6Mjk6MjA6NDM6Njg6NzI6NmY6NmQ6NjU6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjA6NTM6NjE6NjY6NjE6NzI6Njk6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6NDU6NjQ6Njc6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjI6MmM6MjI6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6MjI6M2E6MjI6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6M2Q6M2Q6MjI6N2Q6MmM6MjI6NmM6NmY6Njc6Njk6NmU6NWY6NzA6NjE6NzI6NjE6NmQ6NjU6NzQ6NjU6NzI6NzM6MjI6M2E6MjI6NmY6NzI6Njk6Njc6Njk6NmU6M2Q6Njg6NzQ6NzQ6NzA6MjU6MzM6NDE6MjU6MzI6NDY6MjU6MzI6NDY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MjU6MzI6NDY6NjU6NmU6MjU6MzI6NDY6MjU6MzM6NDY6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6MjU6MzM6NDQ6NzQ6NzI6NzU6NjU6MjY6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6M2Q6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MjU6MzI6NDY6MzU6MmU6MzA6MmI6MjU6MzI6Mzg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MmI6NGU6NTQ6MmI6MzE6MzA6MmU6MzA6MjU6MzM6NDI6MmI6NTc6Njk6NmU6MzY6MzQ6MjU6MzM6NDI6MmI6Nzg6MzY6MzQ6MjU6MzI6Mzk6MmI6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6MjU6MzI6Mzg6NGI6NDg6NTQ6NGQ6NGM6MjU6MzI6NDM6MmI6NmM6Njk6NmI6NjU6MmI6NDc6NjU6NjM6NmI6NmY6MjU6MzI6Mzk6MmI6NDM6Njg6NzI6NmY6NmQ6NjU6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MmI6NTM6NjE6NjY6NjE6NzI6Njk6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6NDU6NjQ6Njc6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjY6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6M2Q6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6MjU6MzM6NDQ6MjU6MzM6NDQ6MjI6N2Q6N2Q6MmM6MjA6MjI6NjQ6NjE6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NzU6NzI6NzI6NjU6NmU6NzQ6NWY6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MjI6MmM6MjA6MjI6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MzI6MmU6MzA6MmU6Mzk6MzA6MmU6MzI6MzM6MjI6N2Q6N2Q=68:T418,eyJ0eXBlIjogImdhbGF4eV9kb3dubG9hZF9zdGFydGVkIiwgImRhdGUiOiAiMjAyNS0xMS0wM1QyMzoyNTowMS0wODowMCIsICJ1dWlkIjogIjUzNTllOGE3LTZmOTUtNDQ0Mi1hMzI5LTVjMzZkMDYyM2NjNiIsICJtZXRhIjogeyJjYW1wYWlnbiI6IHsiY2FtcGFpZ24iOnsib3JpZ2luIjoiaHR0cDovL2dhbGF4eTItc2lnbnVwLmdvZy5wcm9kL2VuLz9lbWJlZGRhYmxlPXRydWUiLCJvcmlnaW5fdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xNDIuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTQyLjAuMC4wIiwidW5pcXVlX2lkIjoiMTc2MjIxMjIxMS1WSXpOZW1PNGEzWEcwTThsVGRLNFBBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjE0Mi4wLjAuMCtTYWZhcmklMkY1MzcuMzYrRWRnJTJGMTQyLjAuMC4wJnVuaXF1ZV9pZD0xNzYyMjEyMjExLVZJek5lbU80YTNYRzBNOGxUZEs0UEElM0QlM0QifX0sICJkYXRhIjogeyJjdXJyZW50X3ZlcnNpb24iOiAiIiwgInZlcnNpb24iOiAiMi4wLjkwLjIzIn1969:T51c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIgLz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgICAgICAgIFVBQyBNYW5pZmVzdCBPcHRpb25zICAgICAgICAgICAgIElmIHlvdSB3YW50IHRvIGNoYW5nZSB0aGUgV2luZG93cyBVc2VyIEFjY291bnQgQ29udHJvbCBsZXZlbCByZXBsYWNlIHRoZSAgICAgICAgICAgICAgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbm9kZSB3aXRoIG9uZSBvZiB0aGUgZm9sbG93aW5nLiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iaGlnaGVzdEF2YWlsYWJsZSIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgICAgIFNwZWNpZnlpbmcgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgZWxlbWVudCB3aWxsIGRpc2FibGUgZmlsZSBhbmQgcmVnaXN0cnkgdmlydHVhbGl6YXRpb24uICAgICAgICAgICAgIFJlbW92ZSB0aGlzIGVsZW1lbnQgaWYgeW91ciBhcHBsaWNhdGlvbiByZXF1aXJlcyB0aGlzIHZpcnR1YWxpemF0aW9uIGZvciBiYWNrd2FyZHMgICAgICAgICAgICBjb21wYXRpYmlsaXR5LiAgICAgICAgLS0+ICAgICAgICAgPHJlcXVlc3RlZEV46a:T51c,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPjxjb21wYXRpYmlsaXR5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmNvbXBhdGliaWxpdHkudjEiPiAgICA8YXBwbGljYXRpb24+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyBWaXN0YSAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0ie2UyMDExNDU3LTE1NDYtNDNjNS1hNWZlLTAwOGRlZWUzZDNmMH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA3IC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MzUxMzhiOWEtNWQ5Ni00ZmJkLThlMmQtYTI0NDAyMjVmOTNhfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDggLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MWY2NzZjNzYtODBlMS00MjM5LTk1YmItODNkMGY2ZDBkYTc4fSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDEwIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7OGUwZjdhMTItYmZiMy00ZmU4LWI5YTUtNDhmZDUwYTE1YTlhfSI+PC9zdXBwb3J0ZWRPUz4gICAgPC9hcHBsaWNhdGlvbj48L2NvbXBhdGliaWxpdHk+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNybw==6b:T514,PiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iIC8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9IiAvPiAgICAgICAgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9IiAvPiAgICA8L2FwcGxpY2F0aW9uPiAgPC9jb21wYXRpYmlsaXR5PiAgICBJbmRpY2F0ZXMgdGhhdCB0aGUgYXBwbGljYXRpb24gaXMgRFBJLWF3YXJlIGFuZCB3aWxsIG5vdCBiZSBhdXRvbWF0aWNhbGx5IHNjYWxlZCBieSBXaW5kb3dzIGF0IGhpZ2hlciAgICAgICBEUElzLiBXaW5kb3dzIFByZXNlbnRhdGlvbiBGb3VuZGF0aW9uIChXUEYpIGFwcGxpY2F0aW9ucyBhcmUgYXV0b21hdGljYWxseSBEUEktYXdhcmUgYW5kIGRvIG5vdCBuZWVkICAgICAgICB0byBvcHQgaW4uIFdpbmRvd3MgRm9ybXMgYXBwbGljYXRpb25zIHRhcmdldGluZyAuTkVUIEZyYW1ld29yayA0LjYgdGhhdCBvcHQgaW50byB0aGlzIHNldHRpbmcsIHNob3VsZCAgICAgICAgYWxzbyBzZXQgdGhlICdFbmFibGVXaW5kb3dzRm9ybXNIaWdoRHBpQXV0b1Jlc2l6aW5nJyBzZXR0aW5nIHRvICd0cnVlJyBpbiB0aGVpciBhcHAuY29uZmlnLiAtLT4gIDxhcHBsaWNhdGlvbiB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICA8d2luZG93c1NldHRpbmdzPiAgICAgIDxkcGlBd2FyZSB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9TTUkvMjAwNS9XaW5kb3dzU2V0dGluZ3MiPnRydWU8L2RwaUF3YXJlPiAgICA8L3dpbmRvd3NTZXR0aW5ncz4gIDwvYXBwbGljYXRpb24+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kbw==6c:T514,Y3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPi0tPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgIDxhcHBsaWNhdGlvblJlcXVlc3RNaW5pbXVtPiAgICAgICAgPFBlcm1pc3Npb25TZXQgY2xhc3M9IlN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9uU2V0IiB2ZXJzaW9uPSIxIiBVbnJlc3RyaWN0ZWQ9InRydWUiIElEPSJDdXN0b20iIFNhbWVTaXRlPSJzaXRlIiAvPiAgICAgICAgPGRlZmF1bHRBc3NlbWJseVJlcXVlc3QgcGVybWlzc2lvblNldFJlZmVyZW5jZT0iQ3VzdG9tIiAvPiAgICAgIDwvYXBwbGljYXRpb25SZXF1ZXN0TWluaW11bT4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIEEgbGlzdCBvZiB0aGUgV2luZG93cyB2ZXJzaW9ucyB0aGF0IHRoaXMgYXBwbGljYXRpb24gaGFzIGJlZW4gdGVzdGVkIG9uIGFuZCBpcyAgICAgICAgICAgaXMgZGVzaWduZWQgdG8gd29yayB3aXRoLiBVbmNvbW1lbnQgdGhlIGFwcHJvcHJpYXRlIGVsZW1lbnRzIGFuZCBXaW5kb3dzIHdpbGwgICAgICAgICAgICBhdXRvbWF0aWNhbGx5IHNlbGVjdGVkIHRoZSBtb3N0IGNvbXBhdGlibGUgZW52aXJvbm1lbnQuIC0tPiAgICAgICAgV2luZG93cyBWaXN0YSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9IntlMjAxMTQ1Ny0xNTQ2LTQzYzUtYTVmZS0wMDhkZWVlM2QzZjB9IiAvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iIC8+ICAgICAgICBXaW5kb3dzIDggLQ==6d:T518,ZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIFZpc3RhIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDcgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InszNTEzOGI5YS01ZDk2LTRmYmQtOGUyZC1hMjQ0MDIyNWY5M2F9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA4LjEgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgMTAgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ij48L3N1cHBvcnRlZE9TPiAgICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29m6e:Td6c,UE9TVCAvY2xpZW50cy81MjEzODc3NzA5NDM1OTk2Ny9ldmVudHMgSFRUUC8xLjFDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Vc2VyLUFnZW50OiBHT0dXZWJpbnN0YWxsZXIvMi4wLjczNzYuMjg1MjkgKE1pY3Jvc29mdCBXaW5kb3dzIDEwIFBybylIb3N0OiBpbnNpZ2h0cy1jb2xsZWN0b3IuZ29nLmNvbUNvbnRlbnQtTGVuZ3RoOiA3ODZDb25uZWN0aW9uOiBLZWVwLUFsaXZlN2I6MjI6NzQ6Nzk6NzA6NjU6MjI6M2E6MjA6MjI6Njc6NjE6NmM6NjE6Nzg6Nzk6NWY6NjQ6NmY6Nzc6NmU6NmM6NmY6NjE6NjQ6NWY6NzM6NzQ6NjE6NzI6NzQ6NjU6NjQ6MjI6MmM6MjA6MjI6NjQ6NjE6NzQ6NjU6MjI6M2E6MjA6MjI6MzI6MzA6MzI6MzU6MmQ6MzE6MzE6MmQ6MzA6MzM6NTQ6MzI6MzM6M2E6MzI6MzU6M2E6MzA6MzE6MmQ6MzA6Mzg6M2E6MzA6MzA6MjI6MmM6MjA6MjI6NzU6NzU6Njk6NjQ6MjI6M2E6MjA6MjI6MzU6MzM6MzU6Mzk6NjU6Mzg6NjE6Mzc6MmQ6MzY6NjY6Mzk6MzU6MmQ6MzQ6MzQ6MzQ6MzI6MmQ6NjE6MzM6MzI6Mzk6MmQ6MzU6NjM6MzM6MzY6NjQ6MzA6MzY6MzI6MzM6NjM6NjM6MzY6MjI6MmM6MjA6MjI6NmQ6NjU6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6N2I6MjI6NmY6NzI6Njk6Njc6Njk6NmU6MjI6M2E6MjI6Njg6NzQ6NzQ6NzA6M2E6MmY6MmY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MmY6NjU6NmU6MmY6M2Y6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6M2Q6NzQ6NzI6NzU6NjU6MjI6MmM6MjI6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6MjI6M2E6MjI6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MmY6MzU6MmU6MzA6MjA6Mjg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MjA6NGU6NTQ6MjA6MzE6MzA6MmU6MzA6M2I6MjA6NTc6Njk6NmU6MzY6MzQ6M2I6MjA6Nzg6MzY6MzQ6Mjk6MjA6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6Mjg6NGI6NDg6NTQ6NGQ6NGM6MmM6MjA6NmM6Njk6NmI6NjU6MjA6NDc6NjU6NjM6NmI6NmY6Mjk6MjA6NDM6Njg6NzI6NmY6NmQ6NjU6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjA6NTM6NjE6NjY6NjE6NzI6Njk6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6NDU6NjQ6Njc6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjI6MmM6MjI6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6MjI6M2E6MjI6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6M2Q6M2Q6MjI6N2Q6MmM6MjI6NmM6NmY6Njc6Njk6NmU6NWY6NzA6NjE6NzI6NjE6NmQ6NjU6NzQ6NjU6NzI6NzM6MjI6M2E6MjI6NmY6NzI6Njk6Njc6Njk6NmU6M2Q6Njg6NzQ6NzQ6NzA6MjU6MzM6NDE6MjU6MzI6NDY6MjU6MzI6NDY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MjU6MzI6NDY6NjU6NmU6MjU6MzI6NDY6MjU6MzM6NDY6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6MjU6MzM6NDQ6NzQ6NzI6NzU6NjU6MjY6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6M2Q6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MjU6MzI6NDY6MzU6MmU6MzA6MmI6MjU6MzI6Mzg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MmI6NGU6NTQ6MmI6MzE6MzA6MmU6MzA6MjU6MzM6NDI6MmI6NTc6Njk6NmU6MzY6MzQ6MjU6MzM6NDI6MmI6Nzg6MzY6MzQ6MjU6MzI6Mzk6MmI6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6MjU6MzI6Mzg6NGI6NDg6NTQ6NGQ6NGM6MjU6MzI6NDM6MmI6NmM6Njk6NmI6NjU6MmI6NDc6NjU6NjM6NmI6NmY6MjU6MzI6Mzk6MmI6NDM6Njg6NzI6NmY6NmQ6NjU6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MmI6NTM6NjE6NjY6NjE6NzI6Njk6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6NDU6NjQ6Njc6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjY6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6M2Q6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6MjU6MzM6NDQ6MjU6MzM6NDQ6MjI6N2Q6N2Q6MmM6MjA6MjI6NjQ6NjE6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NzU6NzI6NzI6NjU6NmU6NzQ6NWY6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MjI6MmM6MjA6MjI6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MzI6MmU6MzA6MmU6Mzk6MzA6MmU6MzI6MzM6MjI6N2Q6N2Q=6f:T51c,PGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPjxjb21wYXRpYmlsaXR5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmNvbXBhdGliaWxpdHkudjEiPiAgICA8YXBwbGljYXRpb24+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyBWaXN0YSAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0ie2UyMDExNDU3LTE1NDYtNDNjNS1hNWZlLTAwOGRlZWUzZDNmMH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA3IC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MzUxMzhiOWEtNWQ5Ni00ZmJkLThlMmQtYTI0NDAyMjVmOTNhfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDggLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7MWY2NzZjNzYtODBlMS00MjM5LTk1YmItODNkMGY2ZDBkYTc4fSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDEwIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7OGUwZjdhMTItYmZiMy00ZmU4LWI5YTUtNDhmZDUwYTE1YTlhfSI+PC9zdXBwb3J0ZWRPUz4gICAgPC9hcHBsaWNhdGlvbj48L2NvbXBhdGliaWxpdHk+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNybw==70:T518,ZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIFZpc3RhIC0tPiAgICAgICAgPHN1cHBvcnRlZE9TIElkPSJ7ZTIwMTE0NTctMTU0Ni00M2M1LWE1ZmUtMDA4ZGVlZTNkM2YwfSI+PC9zdXBwb3J0ZWRPUz4gICAgICAgICAgVGhlIElEIGJlbG93IGluZGljYXRlcyBhcHBsaWNhdGlvbiBzdXBwb3J0IGZvciBXaW5kb3dzIDcgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InszNTEzOGI5YS01ZDk2LTRmYmQtOGUyZC1hMjQ0MDIyNWY5M2F9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iPjwvc3VwcG9ydGVkT1M+ICAgICAgICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyA4LjEgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ij48L3N1cHBvcnRlZE9TPiAgICAgICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgMTAgLS0+ICAgICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ij48L3N1cHBvcnRlZE9TPiAgICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29m71:T420,ZXlKc2IyZHBibDl3WVhKaGJXVjBaWEp6SWpvaWIzSnBaMmx1UFdoMGRIQWxNMEVsTWtZbE1rWm5ZV3hoZUhreUxYTnBaMjUxY0M1bmIyY3VjSEp2WkNVeVJtVnVKVEpHSlROR1pXMWlaV1JrWVdKc1pTVXpSSFJ5ZFdVbWIzSnBaMmx1WDNWelpYSmZZV2RsYm5ROVRXOTZhV3hzWVNVeVJqVXVNQ3NsTWpoWGFXNWtiM2R6SzA1VUt6RXdMakFsTTBJclYybHVOalFsTTBJcmVEWTBKVEk1SzBGd2NHeGxWMlZpUzJsMEpUSkdOVE0zTGpNMkt5VXlPRXRJVkUxTUpUSkRLMnhwYTJVclIyVmphMjhsTWprclEyaHliMjFsSlRKR01UUXlMakF1TUM0d0sxTmhabUZ5YVNVeVJqVXpOeTR6Tml0RlpHY2xNa1l4TkRJdU1DNHdMakFtZFc1cGNYVmxYMmxrUFRFM05qSXlNVEl5TVRFdFZrbDZUbVZ0VHpSaE0xaEhNRTA0YkZSa1N6UlFRU1V6UkNVelJDSXNJbU5oYlhCaGFXZHVJanA3SW05eWFXZHBiaUk2SW1oMGRIQTZYQzljTDJkaGJHRjRlVEl0YzJsbmJuVndMbWR2Wnk1d2NtOWtYQzlsYmx3dlAyVnRZbVZrWkdGaWJHVTlkSEoxWlNJc0ltOXlhV2RwYmw5MWMyVnlYMkZuWlc1MElqb2lUVzk2YVd4c1lWd3ZOUzR3SUNoWGFXNWtiM2R6SUU1VUlERXdMakE3SUZkcGJqWTBPeUI0TmpRcElFRndjR3hsVjJWaVMybDBYQzgxTXpjdU16WWdLRXRJVkUxTUxDQnNhV3RsSUVkbFkydHZLU0JEYUhKdmJXVmNMekUwTWk0d0xqQXVNQ0JUWVdaaGNtbGNMelV6Tnk0ek5pQkZaR2RjTHpFME1pNHdMakF1TUNJc0luVnVhWEYxWlY5cFpDSTZJakUzTmpJeU1USXlNVEV0VmtsNlRtVnRUelJoTTFoSE1FMDRiRlJrU3pSUVFUMDlJbjE572:T51c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIgLz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgICAgICAgIFVBQyBNYW5pZmVzdCBPcHRpb25zICAgICAgICAgICAgIElmIHlvdSB3YW50IHRvIGNoYW5nZSB0aGUgV2luZG93cyBVc2VyIEFjY291bnQgQ29udHJvbCBsZXZlbCByZXBsYWNlIHRoZSAgICAgICAgICAgICAgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbm9kZSB3aXRoIG9uZSBvZiB0aGUgZm9sbG93aW5nLiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iaGlnaGVzdEF2YWlsYWJsZSIgdWlBY2Nlc3M9ImZhbHNlIiAvPiAgICAgICAgICAgIFNwZWNpZnlpbmcgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgZWxlbWVudCB3aWxsIGRpc2FibGUgZmlsZSBhbmQgcmVnaXN0cnkgdmlydHVhbGl6YXRpb24uICAgICAgICAgICAgIFJlbW92ZSB0aGlzIGVsZW1lbnQgaWYgeW91ciBhcHBsaWNhdGlvbiByZXF1aXJlcyB0aGlzIHZpcnR1YWxpemF0aW9uIGZvciBiYWNrd2FyZHMgICAgICAgICAgICBjb21wYXRpYmlsaXR5LiAgICAgICAgLS0+ICAgICAgICAgPHJlcXVlc3RlZEV473:T514,PiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iIC8+ICAgICAgICBXaW5kb3dzIDguMSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9IiAvPiAgICAgICAgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9IiAvPiAgICA8L2FwcGxpY2F0aW9uPiAgPC9jb21wYXRpYmlsaXR5PiAgICBJbmRpY2F0ZXMgdGhhdCB0aGUgYXBwbGljYXRpb24gaXMgRFBJLWF3YXJlIGFuZCB3aWxsIG5vdCBiZSBhdXRvbWF0aWNhbGx5IHNjYWxlZCBieSBXaW5kb3dzIGF0IGhpZ2hlciAgICAgICBEUElzLiBXaW5kb3dzIFByZXNlbnRhdGlvbiBGb3VuZGF0aW9uIChXUEYpIGFwcGxpY2F0aW9ucyBhcmUgYXV0b21hdGljYWxseSBEUEktYXdhcmUgYW5kIGRvIG5vdCBuZWVkICAgICAgICB0byBvcHQgaW4uIFdpbmRvd3MgRm9ybXMgYXBwbGljYXRpb25zIHRhcmdldGluZyAuTkVUIEZyYW1ld29yayA0LjYgdGhhdCBvcHQgaW50byB0aGlzIHNldHRpbmcsIHNob3VsZCAgICAgICAgYWxzbyBzZXQgdGhlICdFbmFibGVXaW5kb3dzRm9ybXNIaWdoRHBpQXV0b1Jlc2l6aW5nJyBzZXR0aW5nIHRvICd0cnVlJyBpbiB0aGVpciBhcHAuY29uZmlnLiAtLT4gIDxhcHBsaWNhdGlvbiB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICA8d2luZG93c1NldHRpbmdzPiAgICAgIDxkcGlBd2FyZSB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS9TTUkvMjAwNS9XaW5kb3dzU2V0dGluZ3MiPnRydWU8L2RwaUF3YXJlPiAgICA8L3dpbmRvd3NTZXR0aW5ncz4gIDwvYXBwbGljYXRpb24+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kbw==74:T514,Y3V0aW9uTGV2ZWwgIGxldmVsPSJyZXF1aXJlQWRtaW5pc3RyYXRvciIgdWlBY2Nlc3M9ImZhbHNlIiAvPi0tPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgIDxhcHBsaWNhdGlvblJlcXVlc3RNaW5pbXVtPiAgICAgICAgPFBlcm1pc3Npb25TZXQgY2xhc3M9IlN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9uU2V0IiB2ZXJzaW9uPSIxIiBVbnJlc3RyaWN0ZWQ9InRydWUiIElEPSJDdXN0b20iIFNhbWVTaXRlPSJzaXRlIiAvPiAgICAgICAgPGRlZmF1bHRBc3NlbWJseVJlcXVlc3QgcGVybWlzc2lvblNldFJlZmVyZW5jZT0iQ3VzdG9tIiAvPiAgICAgIDwvYXBwbGljYXRpb25SZXF1ZXN0TWluaW11bT4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPiAgPGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+ICAgIDxhcHBsaWNhdGlvbj4gICAgICAgIEEgbGlzdCBvZiB0aGUgV2luZG93cyB2ZXJzaW9ucyB0aGF0IHRoaXMgYXBwbGljYXRpb24gaGFzIGJlZW4gdGVzdGVkIG9uIGFuZCBpcyAgICAgICAgICAgaXMgZGVzaWduZWQgdG8gd29yayB3aXRoLiBVbmNvbW1lbnQgdGhlIGFwcHJvcHJpYXRlIGVsZW1lbnRzIGFuZCBXaW5kb3dzIHdpbGwgICAgICAgICAgICBhdXRvbWF0aWNhbGx5IHNlbGVjdGVkIHRoZSBtb3N0IGNvbXBhdGlibGUgZW52aXJvbm1lbnQuIC0tPiAgICAgICAgV2luZG93cyBWaXN0YSAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9IntlMjAxMTQ1Ny0xNTQ2LTQzYzUtYTVmZS0wMDhkZWVlM2QzZjB9IiAvPiAgICAgICAgV2luZG93cyA3IC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iIC8+ICAgICAgICBXaW5kb3dzIDggLQ==75:Td6c,UE9TVCAvY2xpZW50cy81MjEzODc3NzA5NDM1OTk2Ny9ldmVudHMgSFRUUC8xLjFDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Vc2VyLUFnZW50OiBHT0dXZWJpbnN0YWxsZXIvMi4wLjczNzYuMjg1MjkgKE1pY3Jvc29mdCBXaW5kb3dzIDEwIFBybylIb3N0OiBpbnNpZ2h0cy1jb2xsZWN0b3IuZ29nLmNvbUNvbnRlbnQtTGVuZ3RoOiA3ODZDb25uZWN0aW9uOiBLZWVwLUFsaXZlN2I6MjI6NzQ6Nzk6NzA6NjU6MjI6M2E6MjA6MjI6Njc6NjE6NmM6NjE6Nzg6Nzk6NWY6NjQ6NmY6Nzc6NmU6NmM6NmY6NjE6NjQ6NWY6NzM6NzQ6NjE6NzI6NzQ6NjU6NjQ6MjI6MmM6MjA6MjI6NjQ6NjE6NzQ6NjU6MjI6M2E6MjA6MjI6MzI6MzA6MzI6MzU6MmQ6MzE6MzE6MmQ6MzA6MzM6NTQ6MzI6MzM6M2E6MzI6MzU6M2E6MzA6MzE6MmQ6MzA6Mzg6M2E6MzA6MzA6MjI6MmM6MjA6MjI6NzU6NzU6Njk6NjQ6MjI6M2E6MjA6MjI6MzU6MzM6MzU6Mzk6NjU6Mzg6NjE6Mzc6MmQ6MzY6NjY6Mzk6MzU6MmQ6MzQ6MzQ6MzQ6MzI6MmQ6NjE6MzM6MzI6Mzk6MmQ6MzU6NjM6MzM6MzY6NjQ6MzA6MzY6MzI6MzM6NjM6NjM6MzY6MjI6MmM6MjA6MjI6NmQ6NjU6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6MjA6N2I6MjI6NjM6NjE6NmQ6NzA6NjE6Njk6Njc6NmU6MjI6M2E6N2I6MjI6NmY6NzI6Njk6Njc6Njk6NmU6MjI6M2E6MjI6Njg6NzQ6NzQ6NzA6M2E6MmY6MmY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MmY6NjU6NmU6MmY6M2Y6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6M2Q6NzQ6NzI6NzU6NjU6MjI6MmM6MjI6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6MjI6M2E6MjI6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MmY6MzU6MmU6MzA6MjA6Mjg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MjA6NGU6NTQ6MjA6MzE6MzA6MmU6MzA6M2I6MjA6NTc6Njk6NmU6MzY6MzQ6M2I6MjA6Nzg6MzY6MzQ6Mjk6MjA6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6Mjg6NGI6NDg6NTQ6NGQ6NGM6MmM6MjA6NmM6Njk6NmI6NjU6MjA6NDc6NjU6NjM6NmI6NmY6Mjk6MjA6NDM6Njg6NzI6NmY6NmQ6NjU6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjA6NTM6NjE6NjY6NjE6NzI6Njk6MmY6MzU6MzM6Mzc6MmU6MzM6MzY6MjA6NDU6NjQ6Njc6MmY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjI6MmM6MjI6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6MjI6M2E6MjI6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6M2Q6M2Q6MjI6N2Q6MmM6MjI6NmM6NmY6Njc6Njk6NmU6NWY6NzA6NjE6NzI6NjE6NmQ6NjU6NzQ6NjU6NzI6NzM6MjI6M2E6MjI6NmY6NzI6Njk6Njc6Njk6NmU6M2Q6Njg6NzQ6NzQ6NzA6MjU6MzM6NDE6MjU6MzI6NDY6MjU6MzI6NDY6Njc6NjE6NmM6NjE6Nzg6Nzk6MzI6MmQ6NzM6Njk6Njc6NmU6NzU6NzA6MmU6Njc6NmY6Njc6MmU6NzA6NzI6NmY6NjQ6MjU6MzI6NDY6NjU6NmU6MjU6MzI6NDY6MjU6MzM6NDY6NjU6NmQ6NjI6NjU6NjQ6NjQ6NjE6NjI6NmM6NjU6MjU6MzM6NDQ6NzQ6NzI6NzU6NjU6MjY6NmY6NzI6Njk6Njc6Njk6NmU6NWY6NzU6NzM6NjU6NzI6NWY6NjE6Njc6NjU6NmU6NzQ6M2Q6NGQ6NmY6N2E6Njk6NmM6NmM6NjE6MjU6MzI6NDY6MzU6MmU6MzA6MmI6MjU6MzI6Mzg6NTc6Njk6NmU6NjQ6NmY6Nzc6NzM6MmI6NGU6NTQ6MmI6MzE6MzA6MmU6MzA6MjU6MzM6NDI6MmI6NTc6Njk6NmU6MzY6MzQ6MjU6MzM6NDI6MmI6Nzg6MzY6MzQ6MjU6MzI6Mzk6MmI6NDE6NzA6NzA6NmM6NjU6NTc6NjU6NjI6NGI6Njk6NzQ6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6MjU6MzI6Mzg6NGI6NDg6NTQ6NGQ6NGM6MjU6MzI6NDM6MmI6NmM6Njk6NmI6NjU6MmI6NDc6NjU6NjM6NmI6NmY6MjU6MzI6Mzk6MmI6NDM6Njg6NzI6NmY6NmQ6NjU6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MmI6NTM6NjE6NjY6NjE6NzI6Njk6MjU6MzI6NDY6MzU6MzM6Mzc6MmU6MzM6MzY6MmI6NDU6NjQ6Njc6MjU6MzI6NDY6MzE6MzQ6MzI6MmU6MzA6MmU6MzA6MmU6MzA6MjY6NzU6NmU6Njk6NzE6NzU6NjU6NWY6Njk6NjQ6M2Q6MzE6Mzc6MzY6MzI6MzI6MzE6MzI6MzI6MzE6MzE6MmQ6NTY6NDk6N2E6NGU6NjU6NmQ6NGY6MzQ6NjE6MzM6NTg6NDc6MzA6NGQ6Mzg6NmM6NTQ6NjQ6NGI6MzQ6NTA6NDE6MjU6MzM6NDQ6MjU6MzM6NDQ6MjI6N2Q6N2Q6MmM6MjA6MjI6NjQ6NjE6NzQ6NjE6MjI6M2E6MjA6N2I6MjI6NjM6NzU6NzI6NzI6NjU6NmU6NzQ6NWY6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MjI6MmM6MjA6MjI6NzY6NjU6NzI6NzM6Njk6NmY6NmU6MjI6M2E6MjA6MjI6MzI6MmU6MzA6MmU6Mzk6MzA6MmU6MzI6MzM6MjI6N2Q6N2Q=76:T874,WzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBTZXR0aW5nIHVwIGd1aSBlbGVtZW50cy5bMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIFBhcnNpbmcgYXJndW1lbnRzOiBbMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIFNldHRpbmcgdXAgbG9jYWxpemVkIHN0cmluZ3MuWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBEZXRlY3RlZCBsYW5ndWFnZSBpcyBlbi1VU1sxMS8zLzIwMjUgMTE6MjU6MDAgUE1dIFtpbmZvcm1hdGlvbl0gTG9hZGluZyBpY29uIGZpbGU6ICVURU1QJVxHYWxheHlJbnN0YWxsZXJfRWd0QnVcaWNvbi5pY29bMTEvMy8yMDI1IDExOjI1OjAwIFBNXSBbaW5mb3JtYXRpb25dIEluc3RhbGxlciBydW5uaW5nIGFzIHVzZXIgSEFQVUJXUyAtIGVsZXZhdGlvbiBzdGF0dXMgVHJ1ZS4gWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBHZXR0aW5nIGpzb24gcmVtb3RlIGNvbmZpZzogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFRlbXBcR2FsYXh5SW5zdGFsbGVyX0VndEJ1XHJlbW90ZWNvbmZpZy5qc29uWzExLzMvMjAyNSAxMToyNTowMCBQTV0gW2luZm9ybWF0aW9uXSBHZXR0aW5nIGpzb24gcmVtb3RlIGNvbmZpZyBzdWNjZXNzZnVsWzExLzMvMjAyNSAxMToyNTowMSBQTV0gW2luZm9ybWF0aW9uXSBTZW5kaW5nIGV2ZW50OiB7InR5cGUiOiAiZ2FsYXh5X2Rvd25sb2FkX3N0YXJ0ZWQiLCAiZGF0ZSI6ICIyMDI1LTExLTAzVDIzOjI1OjAxLTA4OjAwIiwgInV1aWQiOiAiNTM1OWU4YTctNmY5NS00NDQyLWEzMjktNWMzNmQwNjIzY2M2IiwgIm1ldGEiOiB7ImNhbXBhaWduIjogeyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Mi4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xNDIuMC4wLjAiLCJ1bmlxdWVfaWQiOiIxNzYyMjEyMjExLVZJek5lbU80YTNYRzBNOGxUZEs0UEE9PSJ9LCJsb2dpbl9wYXJhbWV0ZXJzIjoib3JpZ2luPWh0dHAlM0ElMkYlMkZnYWxheHkyLXNpZ251cC5nb2cucHJvZCUyRmVuJTJGJTNGZW1iZWRkYWJsZSUzRHRydWUmb3JpZ2luX3VzZXJfYWdlbnQ9TW96aWxsYSUyRjUuMCslMjhXaW5kb3dzK05UKzEwLjAlM0IrV2luNjQlM0IreDY0JTI5K0FwcGxlV2ViS2l0JTJGNTM3LjM2KyUyOEtIVE1MJTJDK2xpa2UrR2Vja28lMjkrQ2hyb21lJTJGMTQyLjAuMC4wK1NhZmFyaSUyRjUzNy4zNitFZGclMkYxNDIuMC4wLjAmdW5pcXVlX2lkPTE3NjIyMTIyMTEtVkl6TmVtTzRhM1hHME04bFRkSzRQQSUzRCUzRCJ9fSwgImRhdGEiOiB7ImN1cnJlbnRfdmVyc2lvbiI6ICIiLCAidmVyc2lvbiI6ICIyLjAuOTAuMjMifX1bMTEvMy8yMDI1IDExOjI1OjA2IFBNXSBbaW5mb3JtYXRpb25dIFNlbmQgcmVzdWx0OiBOb0NvbnRlbnRbMTEvMy8yMDI1IDExOjI1OjA2IFBNXSBbaW5mb3JtYXRpb25dIFN0YXJ0aW5nIGNsaWVudCBkb3dubG9hZC4=77:T418,eyJ0eXBlIjogImdhbGF4eV9kb3dubG9hZF9zdGFydGVkIiwgImRhdGUiOiAiMjAyNS0xMS0wM1QyMzoyNTowMS0wODowMCIsICJ1dWlkIjogIjUzNTllOGE3LTZmOTUtNDQ0Mi1hMzI5LTVjMzZkMDYyM2NjNiIsICJtZXRhIjogeyJjYW1wYWlnbiI6IHsiY2FtcGFpZ24iOnsib3JpZ2luIjoiaHR0cDovL2dhbGF4eTItc2lnbnVwLmdvZy5wcm9kL2VuLz9lbWJlZGRhYmxlPXRydWUiLCJvcmlnaW5fdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xNDIuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTQyLjAuMC4wIiwidW5pcXVlX2lkIjoiMTc2MjIxMjIxMS1WSXpOZW1PNGEzWEcwTThsVGRLNFBBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjE0Mi4wLjAuMCtTYWZhcmklMkY1MzcuMzYrRWRnJTJGMTQyLjAuMC4wJnVuaXF1ZV9pZD0xNzYyMjEyMjExLVZJek5lbU80YTNYRzBNOGxUZEs0UEElM0QlM0QifX0sICJkYXRhIjogeyJjdXJyZW50X3ZlcnNpb24iOiAiIiwgInZlcnNpb24iOiAiMi4wLjkwLjIzIn1978:T9c8,SUhEUklEQVR4Z24+cSxIKmhZUSZOPTdUK0NgdEQmI1EiLjJZUCdIXE8yS1NBTXRNY0V7OjdTMV9LMyIjaEIsO1hxYDVHV21Efl9TcyFGXERkZH5ZKkJtLEsoJC19XCxyMiU6dGxeRy58Xm9fKkJTJFY9NFBuNlBWbXRifl52XXNfL1hoSHUuX1V1Py5ed3w6fCgiWFRhLzN6X31lfCoydXd9VS4ldjh3KCU5YSBTcT8+bi5qLV9TeFFPOT5WYyV+eEAsczE1UE9hcDhtIEwsb0l1K2Y7QmFNSC9GLD07S3pDeT5PW3x7Uzw5bj9gYnswfUN+V3YqekhaT1MlTExyOD8+Pz9Bel1tY0R+QUIjW0UsUkYzTTs/aykwI3wsIVlyLHgzfUhiUFFqM283d1ZTNTg0KUMjeisucm9BOHo9NVMpSmgnbVwtNGt6MF13XWI0eF41X0pHWW08UmtnalUvKyRuel1SPEV+Oyo2U2wuLk8wfVV8TDJUTl8oKDBDLyItTDxFZDFkLldcTTJ8JS4uKk8qfFFiViVUSXctWkRvPSJaLk5tSD9UVVB5JiZ5a2lzUSRsRT0zRCJSQ3h4aD43QDxdQzx0c2dtTT57T3pXPG9kfGFBIiF8bm89dSYjcz1XMlQ4R2heRDJSaUVadng/QGFpRX1JaT1nNFAicFhyayMmI2FpVV1UL34/eSVsSEh3XVZGIn1VPCkqMHouW2c+Mn4rYyF6TzFYS1h9STRce34+XnN9RXUwZ1xpI0JZajl0R2N5KSFvWExiUCdNVTZkWC5PI1FCb3JHckYhUXRaUH47cEgoZy88N1ZnentLR2JWV0ROID1yXlNSeSZ9Ln1qQX1zMU8lcF4zMl5GV2xyVlMydE98KGF5KW84J1gnODBhcCJSPzRRdFd3UmlfVkhUL2krR2N6Zn5gKD5uUnxyfHs7JDN7VVo2PjIodzxmblgkKj5XanJTLylgaT1rRWYsd2JkK2ogfGZFKyBuIShgcCI9ei11fTF7IygufT9BPGVPe3hvNWV5IlMvXzw5PHdsPj5ZNj40Kmx3IXdIcFQsajIwSkQiM0NlfTgtckZBLkZ7ci4+WkhtUltDWy1jXlp1bDw2J3FzdCdlKidlcVVOOy9tMGgxI0Y5SiJwOGI3dUpUYCssNDpVZG5jMkczb2FMRDZqQF0+SnVmNCplNTUqaTIuPi9uIkhgNX4pLFpWblJrIUA2dm8hI2A9OkZqI00uSkx8XGsgXXE/QmNtWyM4XnV8andeImR2U3Y1TF1kdDU9bld2Vk83N25RJElRIi1pVlc2IWIwRlBcQVlXWHEoL2BIKWxaQGFFel5tKUNSRD1iLj0/J1Z7PldgLkBRV1lAIlk/KGZiLjluYjlMPSAyYzIpPm43XngyIHYtNFhXQTQmSms5bUsya28zNmA2V3JbfEc2bl5CejFmIjFXb0ssLWZhSFErTyMkaldUYFlRXnY4SzMmdWJwT3Y4S3ZDIiIqNS1pN3U0fV8taDM2U09dRSc0MzA+W0I1N2BwOF5HPV0gQjI0OCAxMEAuY0Y5fGU0dyBHLExXcmV4KERsXlh8enlpfGtvYG5OPFUsLSlZJnZuXnRPM2RsY3B9QSg6fG0oRDMqcDwxeyFvblswJzMjbzN0NywvK2kqWCtudl5VPEJlVD9nOlEhOihGOHJXXDl7dkYnc0w+N2FsY2VlWSdTbC1nW2xicWxhZkhVRzhMSDdbZzNMYiJMUEZOMCpKNkJRL1soLCptWVZGV199MXBMKGIjcyBsbGcpPyE+N18+KWJ9TUA2cTx7KSdKfExLW1tvW10iX1s6PWV3IydaOW1tIDE/fDYvZTx3OngobVFHZGA0WXN5bHw6YkhHb18gb25nPGpCXH08PUZ1ZmNYfiBlayEyeCxfVUZvekRfOnV6ajJxY2U9JmtreW1Nb3UtfnUiWm1lSWg1TUg6V1BlX0R5VmshdiRhZT0pVUtLUXkuRDhKenk5ekUnTTVdI19tcy5FMV5rOG0qfXxCfkBvcDI/YWklZmktYjBjPHZvPmc4NF1hI2B6WSEkZ0AscC8kcUlxTnFWKnlWIHhnR15AMzZHaSpsb1QxO29aInxce1ZtSUgtKTluWV1VdnY1JiFJQDlCJiJzO1d1NUNbeGp3T0c5SmxHfmg5fFM+PVU4T2BRbjs/flk9ZiFXbVgkfVc9TWh4YV1+NiZoYiFkL1J+aEx9Ll43dkE8ZVZcaD4pbVldcWxtNmkiNC9VSFo6Qn0qVF8tbUE/bTJ+Z2dTXlZvZ104Lz8tZUAlMjBibyM4PmYsYngnSURBVCMzeWp+LksoUkZjOX19YkFlWkA4NztvQHllTFNiMXxZKnlCcnhZWV9VVnc/RllrYWdXTSZ8SSwvOVY1WlhSK3pfc2pWWnlaQHktIFJMKHFkZyRfeFJcZ0NuKi4gMT1vQnp+NXBxVCB1IVJVLCtjKHgkN3tcfkpkempVS1lZeVJ8SEQvOUUte280SUVORF04OA==79:T62c, 0 : 47 45 54 20 2F 63 6F 6D 70 6F 6E 65 6E 74 73 2F [GET /components/] 10 : 77 65 62 69 6E 73 74 61 6C 6C 65 72 3F 63 6F 6D [webinstaller?com] 20 : 70 6F 6E 65 6E 74 5F 76 65 72 73 69 6F 6E 3D 32 [ponent_version=2] 30 : 2E 30 2E 30 20 48 54 54 50 2F 31 2E 31 0A 41 63 [.0.0 HTTP/1.1.Ac] 40 : 63 65 70 74 3A 20 2A 2F 2A 0A 41 63 63 65 70 74 [cept: */*.Accept] 50 : 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C [-Encoding: gzip,] 60 : 20 64 65 66 6C 61 74 65 0A 55 73 65 72 2D 41 67 [ deflate.User-Ag] 70 : 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 [ent: Mozilla/4.0] 80 : 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 [ (compatible; MS] 90 : 49 45 20 37 2E 30 3B 20 57 69 6E 64 6F 77 73 20 [IE 7.0; Windows ] A0 : 4E 54 20 31 30 2E 30 3B 20 57 4F 57 36 34 3B 20 [NT 10.0; WOW64; ] B0 : 54 72 69 64 65 6E 74 2F 37 2E 30 3B 20 2E 4E 45 [Trident/7.0; .NE] C0 : 54 34 2E 30 43 3B 20 2E 4E 45 54 34 2E 30 45 3B [T4.0C; .NET4.0E;] D0 : 20 49 6E 66 6F 50 61 74 68 2E 33 3B 20 2E 4E 45 [ InfoPath.3; .NE] E0 : 54 20 43 4C 52 20 32 2E 30 2E 35 30 37 32 37 3B [T CLR 2.0.50727;] F0 : 20 2E 4E 45 54 20 43 4C 52 20 33 2E 30 2E 33 30 [ .NET CLR 3.0.30] 100 : 37 32 39 3B 20 2E 4E 45 54 20 43 4C 52 20 33 2E [729; .NET CLR 3.] 110 : 35 2E 33 30 37 32 39 29 0A 48 6F 73 74 3A 20 72 [5.30729).Host: r] 120 : 65 6D 6F 74 65 2D 63 6F 6E 66 69 67 2E 67 6F 67 [emote-config.gog] 130 : 2E 63 6F 6D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A [.com.Connection:] 140 : 20 4B 65 65 70 2D 41 6C 69 76 65 0A [ Keep-Alive.] 7a:Tdec, 0 : 50 4F 53 54 20 2F 63 6C 69 65 6E 74 73 2F 35 32 [POST /clients/52] 10 : 31 33 38 37 37 37 30 39 34 33 35 39 39 36 37 2F [138777094359967/] 20 : 65 76 65 6E 74 73 20 48 54 54 50 2F 31 2E 31 0A [events HTTP/1.1.] 30 : 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 [Content-Type: ap] 40 : 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 0A 55 [plication/json.U] 50 : 73 65 72 2D 41 67 65 6E 74 3A 20 47 4F 47 57 65 [ser-Agent: GOGWe] 60 : 62 69 6E 73 74 61 6C 6C 65 72 2F 32 2E 30 2E 37 [binstaller/2.0.7] 70 : 33 37 36 2E 32 38 35 32 39 20 28 4D 69 63 72 6F [376.28529 (Micro] 80 : 73 6F 66 74 20 57 69 6E 64 6F 77 73 20 31 30 20 [soft Windows 10 ] 90 : 50 72 6F 29 0A 48 6F 73 74 3A 20 69 6E 73 69 67 [Pro).Host: insig] A0 : 68 74 73 2D 63 6F 6C 6C 65 63 74 6F 72 2E 67 6F [hts-collector.go] B0 : 67 2E 63 6F 6D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 [g.com.Content-Le] C0 : 6E 67 74 68 3A 20 37 38 36 0A 43 6F 6E 6E 65 63 [ngth: 786.Connec] D0 : 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 [tion: Keep-Alive] E0 : 0A 37 62 3A 32 32 3A 37 34 3A 37 39 3A 37 30 3A [.7b:22:74:79:70:] F0 : 36 35 3A 32 32 3A 33 61 3A 32 30 3A 32 32 3A 36 [65:22:3a:20:22:6] 100 : 37 3A 36 31 3A 36 63 3A 36 31 3A 37 38 3A 37 39 [7:61:6c:61:78:79] 110 : 3A 35 66 3A 36 34 3A 36 66 3A 37 37 3A 36 65 3A [:5f:64:6f:77:6e:] 120 : 36 63 3A 36 66 3A 36 31 3A 36 34 3A 35 66 3A 37 [6c:6f:61:64:5f:7] 130 : 33 3A 37 34 3A 36 31 3A 37 32 3A 37 34 3A 36 35 [3:74:61:72:74:65] 140 : 3A 36 34 3A 32 32 3A 32 63 3A 32 30 3A 32 32 3A [:64:22:2c:20:22:] 150 : 36 34 3A 36 31 3A 37 34 3A 36 35 3A 32 32 3A 33 [64:61:74:65:22:3] 160 : 61 3A 32 30 3A 32 32 3A 33 32 3A 33 30 3A 33 32 [a:20:22:32:30:32] 170 : 3A 33 35 3A 32 64 3A 33 31 3A 33 31 3A 32 64 3A [:35:2d:31:31:2d:] 180 : 33 30 3A 33 33 3A 35 34 3A 33 32 3A 33 33 3A 33 [30:33:54:32:33:3] 190 : 61 3A 33 32 3A 33 35 3A 33 61 3A 33 30 3A 33 31 [a:32:35:3a:30:31] 1A0 : 3A 32 64 3A 33 30 3A 33 38 3A 33 61 3A 33 30 3A [:2d:30:38:3a:30:] 1B0 : 33 30 3A 32 32 3A 32 63 3A 32 30 3A 32 32 3A 37 [30:22:2c:20:22:7] 1C0 : 35 3A 37 35 3A 36 39 3A 36 34 3A 32 32 3A 33 61 [5:75:69:64:22:3a] 1D0 : 3A 32 30 3A 32 32 3A 33 35 3A 33 33 3A 33 35 3A [:20:22:35:33:35:] 1E0 : 33 39 3A 36 35 3A 33 38 3A 36 31 3A 33 37 3A 32 [39:65:38:61:37:2] 1F0 : 64 3A 33 36 3A 36 36 3A 33 39 3A 33 35 3A 32 64 [d:36:66:39:35:2d] 200 : 3A 33 34 3A 33 34 3A 33 34 3A 33 32 3A 32 64 3A [:34:34:34:32:2d:] 210 : 36 31 3A 33 33 3A 33 32 3A 33 39 3A 32 64 3A 33 [61:33:32:39:2d:3] 220 : 35 3A 36 33 3A 33 33 3A 33 36 3A 36 34 3A 33 30 [5:63:33:36:64:30] 230 : 3A 33 36 3A 33 32 3A 33 33 3A 36 33 3A 36 33 3A [:36:32:33:63:63:] 240 : 33 36 3A 32 32 3A 32 63 3A 32 30 3A 32 32 3A 36 [36:22:2c:20:22:6] 250 : 64 3A 36 35 3A 37 34 3A 36 31 3A 32 32 3A 33 61 [d:65:74:61:22:3a] 260 : 3A 32 30 3A 37 62 3A 32 32 3A 36 33 3A 36 31 3A [:20:7b:22:63:61:] 270 : 36 64 3A 37 30 3A 36 31 3A 36 39 3A 36 37 3A 36 [6d:70:61:69:67:6] 280 : 65 3A 32 32 3A 33 61 3A 32 30 3A 37 62 3A 32 32 [e:22:3a:20:7b:22] 290 : 3A 36 33 3A 36 31 3A 36 64 3A 37 30 3A 36 31 3A [:63:61:6d:70:61:] 2A0 : 36 39 3A 36 37 3A 36 65 3A 32 32 3A 33 61 3A 37 [69:67:6e:22:3a:7] 2B0 : 62 3A 32 32 3A 36 66 3A 37 32 3A 36 39 3A 36 37 [b:22:6f:72:69:67] 2C0 : 3A 36 39 3A 36 65 3A 32 32 3A 33 61 3A 32 32 3A [:69:6e:22:3a:22:] 2D0 : 36 38 3A 37 34 3A 37 34 3A 37 30 3A 33 61 3A 32 [68:74:74:70:3a:2] 2E0 : 66 3A 32 66 3A 36 37 3A 36 31 3A 36 63 3A [f:2f:67:61:6c:] 1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"690939ada9aff495330ff3f7","environment_id":160,"environment_description":"Windows 10 64 bit","size":986672,"type":"PE32 executable for MS Windows 5.01 (GUI), Intel i386, UPX compressed, 3 sections","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"GOG_Galaxy_2.0.exe","md5":"84a2355d1c989705d7eb8e8728ccede7","sha1":"118431235dba52027f5ce385ede11691f4355ccb","sha256":"d1d6c46a8a9df6d0136c13dfb7df8a9774cea45ff8c96d3bd45f59ec26a1e5ae","sha512":"9d91c793988bad96683522160364c85a483de0f4afebc2bab0732877db5323d410d7bd17617a2998e5691083b941fcfb873f74279ab825ed5411f4a5ab285720","ssdeep":"12288:x27p5j8DPeuUSFHqLV+JjY4UW61O4RAxDleFbWQCQTFgSYyAzB+Q/uLnK3S:x27EDFHqLy826My+QiyGJyAV+muLK3S","imphash":"0b5d23895837448a329cb1b4dc10916a","entrypoint":"0x5c62e0","entrypoint_section":"UPX1","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","32BIT_MACHINE"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT","TERMINAL_SERVER_AWARE"],"major_os_version":"5","minor_os_version":"1","av_detect":7,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-11-03T23:24:31+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[{"owner":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","issuer":"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"e9b188ef9d02de7efdb50e20840185a","md5":"8D:DD:0B:C6:D9:D7:70:EB:6B:2B:67:1A:86:28:55:CC","sha1":"A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6","valid_from":"2022-08-01T00:00:00+00:00","valid_until":"2031-11-09T23:59:59+00:00"},{"owner":"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"8ad40b260d29c4c9f5ecda9bd93aed9","md5":"D9:12:99:E8:43:55:CD:8D:5A:86:79:5A:01:18:B6:E9","sha1":"7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C","valid_from":"2021-04-29T00:00:00+00:00","valid_until":"2036-04-28T23:59:59+00:00"},{"owner":"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"dc7ac5705ff21992e4043220c3a4986","md5":"E8:45:C3:0B:A9:F0:58:B0:FE:A9:95:40:92:E1:F0:C0","sha1":"07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4","valid_from":"2025-05-07T00:00:00+00:00","valid_until":"2038-01-14T23:59:59+00:00"},{"owner":"CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert, Inc.\", C=US","serial_number":"a80ef184b8df10582d1c476a7957468","md5":"39:C1:22:79:23:AB:74:F5:63:D9:23:28:82:A7:8F:50","sha1":"DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E","valid_from":"2025-06-04T00:00:00+00:00","valid_until":"2036-09-03T23:59:59+00:00"},{"owner":"CN=\"GOG sp. z o.o\", O=\"GOG sp. z o.o\", L=WARSZAWA, ST=MAZOWIECKIE, C=PL","issuer":"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert, Inc.\", C=US","serial_number":"bb365e0aa6ac0bb473f5e4122062bd6","md5":"89:68:29:9E:56:AE:60:65:33:6E:65:E3:86:6B:CF:12","sha1":"DF:1C:BC:F2:B1:AF:03:6C:55:D1:22:A8:8A:27:19:D3:22:79:16:A8","valid_from":"2025-02-19T00:00:00+00:00","valid_until":"2026-02-18T23:59:59+00:00"}],"is_certificates_valid":true,"certificates_validation_message":null,"domains":["content-system.gog.com","insights-collector.gog.com","remote-config.gog.com"],"compromised_hosts":[],"hosts":["151.101.1.55","151.101.65.55"],"total_network_connections":2,"total_processes":2,"total_signatures":260,"extracted_files":[{"name":"InstallerWebinstaller.log","file_path":"%ALLUSERSPROFILE%\\GOG.com\\Galaxy\\logs\\InstallerWebinstaller.log","file_size":1670,"md5":"58923d3bf299553e8b86d43d4a911e7a","sha1":"47f974b7af1f71e1ed8fb7574dd73b008a04e392","sha256":"73b200b80af25e7307f5f69f3df774bfbf2375ed8f83edf7e1c2e6efe806418a","sha512":"36935041897256e5231d48158c7345d0169557a9ded4d7462f50508adbcc37e8265fac80d5abf7b2decc4d3506916b3f83b4094cd1c808a3cda83c271ac55290","type_tags":["unknown"],"description":"ASCII text, with very long lines (839), with CRLF line terminators","runtime_process":"GalaxyInstaller.exe (PID: 6884)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=bb75499acf55dcb3d3f5082d5d0b624fe01f4f8e90b24c26e94ac2f059f5d0787c45e655874995e99f2569d0d8d49d1999b6046b4cd5b7c732d153bac97e25a8662d8cd404cb75f7c6408ee74c46d9a0dc6d2991","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=bb75499acf55dcb3d3f5082d5d0b624fe01f4f8e90b24c26e94ac2f059f5d0787c45e655874995e99f2569d0d8d49d1999b6046b4cd5b7c732d153bac97e25a8662d8cd404cb75f7c6408ee74c46d9a0dc6d2991","has_overview":false,"extended_details":null},{"name":"icon.ico","file_path":"%TEMP%\\GalaxyInstaller_EgtBu\\icon.ico","file_size":491842,"md5":"391cf634b3ccf3971811be5ef016fe32","sha1":"8e3023466d02dfb8f2e1b48555b998532dc9a377","sha256":"de9a2072df66c11af8cc255788c4c572f7b45ba7ab19524ad2e01a23f55e9ca8","sha512":"c1594a33efcfac7c6e6935e76ed030855886453b6397ba53a63225efbeb513a1ccb39ea7d528cc43bb1e2b56fd0e02b306e0e65dc6896613c2b4ca6c4a165d9a","type_tags":["image","ico"],"description":"MS Windows icon resource - 17 icons, 112x112, 32 bits/pixel, -128x-128, 32 bits/pixel","runtime_process":"GOG_Galaxy_2.0.exe (PID: 5040)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=78a8f7205ed6192fe700aa268f951ee628ce9f6e2456c90b72e8728929d25c9e29ffd5102f5837aee8304c92c6e53c91ca170331ae235affd46711bb227d209a231334","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=78a8f7205ed6192fe700aa268f951ee628ce9f6e2456c90b72e8728929d25c9e29ffd5102f5837aee8304c92c6e53c91ca170331ae235affd46711bb227d209a231334","has_overview":true,"extended_details":null},{"name":"payload.base64","file_path":"%TEMP%\\GalaxyInstaller_EgtBu\\payload.base64","file_size":792,"md5":"05ad4098c75c3d83455573c432634881","sha1":"bf23747e6a3b598c9fe97430cda90e15003adbf6","sha256":"871823a22dab2c9929ba8678e6a04cf73a471961136bd966024d7adbdcef230d","sha512":"67820fff2369b18ce85f342c573ea0e287650b468071cae8b57236ba0a7c9c2cd745041424aab4dbfc04d29656534a321e5b97decccacca274a6640e74ba9b95","type_tags":["unknown"],"description":"ASCII text, with very long lines (792), with no line terminators","runtime_process":"GOG_Galaxy_2.0.exe (PID: 5040)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=b4fa32bb6d690d5b6f610232e0c22bfa51fa29b9a10fba7eefdced19631edf0e852d488b96adb55a8af1afcdb0bf9cd0740f944c882526853131daacbb51f451aa90170751c23c318d","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=b4fa32bb6d690d5b6f610232e0c22bfa51fa29b9a10fba7eefdced19631edf0e852d488b96adb55a8af1afcdb0bf9cd0740f944c882526853131daacbb51f451aa90170751c23c318d","has_overview":false,"extended_details":null},{"name":"payload.campaign","file_path":"%TEMP%\\GalaxyInstaller_EgtBu\\payload.campaign","file_size":585,"md5":"827c46bcb29621b2725bd83a8a3a0274","sha1":"db3db68ec46ab740f1cabc01b92d5b56eddc8c43","sha256":"7ac346625a63bc82f694eaa55a2d6570dec3e1c987677e16c294d0b1bf526511","sha512":"a9dffe44463f19056e778182c0ca7290bd026ab6ddea4fc04b94cde83d6169b00d5fbc427e2a569ff2ab3ac5269953e82ebcc6cde5b716f1b9a5d544548c6478","type_tags":["unknown"],"description":"JSON text data","runtime_process":"GOG_Galaxy_2.0.exe (PID: 5040)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=822452a8aadcd58c13f18ce51a181a3f325708532f2401b4f128ef79a61fb65d8a7bde5a5f1b4f26fd05a1c65419aee74da7de78d5079b881577c201f920e4a6554ee97df7198466be5b33","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=822452a8aadcd58c13f18ce51a181a3f325708532f2401b4f128ef79a61fb65d8a7bde5a5f1b4f26fd05a1c65419aee74da7de78d5079b881577c201f920e4a6554ee97df7198466be5b33","has_overview":false,"extended_details":null},{"name":"remoteconfig.json","file_path":"%TEMP%\\GalaxyInstaller_EgtBu\\remoteconfig.json","file_size":533,"md5":"53a8bab589173ce80f358bb89742f8e3","sha1":"37d4f96f03a71ba9d43c671c8363c92daf2daf5d","sha256":"0bf393564b5d8b6fd90c858b1a79426e992e2c2b08de32c899fb7a8bffe18c74","sha512":"d6d79fcfaaf77ea5b58afb8b541aed9e00217b6cc5fd0d621ac5c5633209bc74bf8dcbc2db56774f8a2fe408b4a8aeda4f890005fb17c415e4492e88680f997b","type_tags":["unknown"],"description":"JSON text data","runtime_process":"GOG_Galaxy_2.0.exe (PID: 5040)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=f651f7a294df070be501603bc1420cb109566aadfc9a180fef7ef64bd0ada1fd5e9544df070c474baa108fc2670e66f5c2584565314404b8c18347f69e6c7dfa8cc50b1feb931d3c47987776","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=f651f7a294df070be501603bc1420cb109566aadfc9a180fef7ef64bd0ada1fd5e9544df070c474baa108fc2670e66f5c2584565314404b8c18347f69e6c7dfa8cc50b1feb931d3c47987776","has_overview":false,"extended_details":null},{"name":"webinstaller_1_.json","file_path":null,"file_size":533,"md5":"53a8bab589173ce80f358bb89742f8e3","sha1":"37d4f96f03a71ba9d43c671c8363c92daf2daf5d","sha256":"0bf393564b5d8b6fd90c858b1a79426e992e2c2b08de32c899fb7a8bffe18c74","sha512":"d6d79fcfaaf77ea5b58afb8b541aed9e00217b6cc5fd0d621ac5c5633209bc74bf8dcbc2db56774f8a2fe408b4a8aeda4f890005fb17c415e4492e88680f997b","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/690939ada9aff495330ff3f7/download/dropped-file?key=aa9308db4454e3843b3605b29cde3aa7303b55d9cd8566d254fce28631b2bc936757fbd7bb5fc4f385d7c4b54e829663f1ae62aa537ca7445697af553e0d73a01913eaa5de5fac9f744440c5be6917","submit_link":"/bff/report/690939ada9aff495330ff3f7/submit/dropped-file?key=aa9308db4454e3843b3605b29cde3aa7303b55d9cd8566d254fce28631b2bc936757fbd7bb5fc4f385d7c4b54e829663f1ae62aa537ca7445697af553e0d73a01913eaa5de5fac9f744440c5be6917","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 24234)","1 Unknown Resource Files (build: 0)","3 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 24234)"],"imported_objects":["13 .LIB Files generated with LIB.EXE 9.00 (Visual Studio 2008) (build: 30729)","37 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 24123)","118 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 24123)","24 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 24123)"],"file_analysis":["File appears to contain raw COFF/OMF content","File is the product of a small codebase (0 files)"],"total_file_compositions_imports":161},"processes":[{"uid":"00000000-00005040","parentuid":null,"name":"GOG_Galaxy_2.0.exe","normalized_path":"C:\\GOG_Galaxy_2.0.exe","command_line":null,"sha256":"d1d6c46a8a9df6d0136c13dfb7df8a9774cea45ff8c96d3bd45f59ec26a1e5ae","av_label":"Trojan.Wacatac","av_matched":2,"av_total":26,"pid":"5040","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"2/26"}]},{"uid":"00000000-00006884","parentuid":"00000000-00005040","name":"GalaxyInstaller.exe","normalized_path":"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe","command_line":null,"sha256":"61eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635","av_label":null,"av_matched":null,"av_total":null,"pid":"6884","icon":null,"process_flags":[{"name":"Network Activity","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Imports suspicious APIs","Contains ability to retrieve the command-line string for the current process","Contains ability to retrieve the fully qualified path of module"],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to execute an application (API string)","Contains ability to create/open files (API string)","Contains ability to load modules (API string)","Contains ability to execute Windows APIs","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to find and load resources of specific modules (API string)","Calls an API typically used to load a resource in memory","Calls an API typically used to retrieve function addresses","Calls an API typically used to find a resource in a module","Calls an API typically used to create a process","Contains ability to dynamically load libraries"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve command line parameters of the running process","Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Fails to load modules at runtime","Loads the RPC (Remote Procedure Call) module DLL","Loads the .NET runtime environment"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found named pipe like strings"],"parent":null},{"tactic":"Execution","technique":"Malicious File","attck_id":"T1204.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1204/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["YARA signature match - Possible payload download using Office macros"],"parent":{"technique":"User Execution","attck_id":"T1204","attck_id_wiki":"https://attack.mitre.org/techniques/T1204"}},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Persistence","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to access device drivers","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Transport Agent","attck_id":"T1505.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to establish persistence using Exchange transport agent (.NET)"],"parent":{"technique":"Server Software Component","attck_id":"T1505","attck_id_wiki":"https://attack.mitre.org/techniques/T1505"}},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to access device drivers","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attck_id":"T1068","attck_id_wiki":"https://attack.mitre.org/techniques/T1068","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Entrypoint in PE header is within an uncommon section","CRC value set in PE header does not match actual value"],"informative_identifiers_count":10,"informative_identifiers":["Contains ability to use Cryptographic classes","Contains CRYPTO related strings","Found XOR operators (encryption/decryption)","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","PE file contains zero-sized sections","Sample file has high entropy (likely encrypted/compressed content)","YARA signature match - RC4 Encryption","YARA signature match – ROR algorithm","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)","Contains ability to register a top-level exception handler (often used as anti-debugging trick)"],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to decode base64 data","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to query local/system time as file time"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Found virtual disk drive like strings","Contains reference to method used by Windows shell items (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the CLR Loader DLL"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["PE file is packed with UPX"],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Looks up many procedures within the same disassembly stream (often used to hide usage)"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attck_id":"T1027.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains XOR operation loops [Stream disassembly]","XOR operations in executable file detected"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Contains ability to detect virtual environment (API)","Makes a code branch decision directly after an API that is environment aware"],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["The input sample is signed with a valid certificate","The input sample is signed with a certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["YARA signature match - High entropy file","YARA signature match - Medium entropy File"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attck_id":"T1558","attck_id_wiki":"https://attack.mitre.org/techniques/T1558","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access credential file using Kerberos"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to query system locale information (API string)","Contains ability to query the system locale"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":5,"suspicious_identifiers":["Checks warning level of secure to non-secure traffic redirection","Read windows product name from registry"],"informative_identifiers_count":8,"informative_identifiers":["Contains registry location strings","Able to query registry keys (API string)","Found registry location strings in memory","Queries registry keys","Opens registry keys","Queries TCP/IP interface details","Accesses Software Policy Settings","Reads Windows Trust Settings"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)","Contains ability to register a top-level exception handler (often used as anti-debugging trick)"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":13,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to read files (API string)","Contains ability to verify if file exist on disk (API string)","References Windows file paths for DLLs (possible dropped files)","Tries to access non-existent files (executable)","Reads files","Able to rename or move file/directory (API string)","Contains ability to enumerate files on disk (API string)","Touches files in the Windows directory","Touches files","Tries to access non-existent files (non-executable)","Contains ability to verify if file exist on disk","Contains ability to enumerate files inside a directory"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to retrieve a module handle"],"informative_identifiers_count":16,"informative_identifiers":["Contains ability to retrieve the OS information (API string)","Contains reference to mutex-related activity (API string)","Contains ability to retrieve a module handle (API string)","Calls an API typically used to open an existing named mutex object","Attempts to call APIs to gather system and hardware detail","Able to retrieve geographical location information","Able to gather system information (.NET)","Able to retrieve information about the current system (API string)","Calls an API typically used to get product type","Reads information about supported languages","Reads the cryptographic machine GUID","Calls an API typically used to get system version information","Reads system-defined device setup information from registry","Contains ability to read software policies","Reads the active computer name","Contains ability to query the machine version"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":9,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Queries process information","Contains ability to retrieve/open a process (API string)","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process","Spawns new processes that are not known child processes","Spawns new processes","Process launched with changed environment","Contains ability to retrieve/open a process"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Able to retrieve date formats supported by the local system (API string)","Contains ability to retrieve machine timezone (API string)","Contains ability to query machine time","Contains ability to query the machine timezone"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve user privileges (API string)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Calls an API possibly used to retrieve a handle to the foreground window","Calls an API typically used to get active windows title","Calls an API typically used to get handle of currently active window"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to retrieve system language (API string)","Reads the windows installation language","Contains ability to retrieve system language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to implement anti-virtualization techniques using MAC address detection"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Contains ability to detect virtual environment (API)","Makes a code branch decision directly after an API that is environment aware"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to move file or directory (API string)","Calls an API typically used to create an instance of a named pipe"],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":1,"malicious_identifiers":["Tries to steal Mail credentials from registry"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to create directories (API string)","Creates directory on disk","Writes log files","Calls an API typically used to create a directory"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Contains ability to find and load resources of a specific module"],"informative_identifiers_count":1,"informative_identifiers":["Writes files in a temp directory"],"parent":null},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API possibly used to take screenshots"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Found potential URL in binary/memory","Found potential IP address in binary/memory","Contains ability to communicate with network (API string)","Found potential URLs in memory dumps","Contains references to network communication API (string)","Contacts server","Contacts domains"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Decrypted SSL network traffic","Possibly tries to communicate over SSL connection (HTTPS)","Uses HTTPS for communication","Makes HTTPS connections using secure TLS/SSL version"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":1,"malicious_identifiers":["GETs executable from a webserver (HTTPS)"],"suspicious_identifiers_count":4,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to download a file from a URL (API string)","Contains ability to write files (API string)","Calls an API typically used to retrieve the URL data","Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":2,"malicious_identifiers":["Found more than one unique user-agent","Found unknown user-agent(s)"],"suspicious_identifiers_count":7,"suspicious_identifiers":["Sends traffic on typical HTTP outbound port, but without HTTP header","Uses a browser-related user-agent without launching browser"],"informative_identifiers_count":8,"informative_identifiers":["Found user-agent related strings","Found string related to HTTP headers","Communicates with HTTPS webserver (GET/POST requests)","Contains reference to Windows HTTP services (API string)","Communicates with HTTP webserver (GET/POST requests)","Sends GET/POST requests (HTTPS)","GETs files from a webserver","GETs files from a webserver (HTTPS)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Mail Protocols","attck_id":"T1071.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found mail related domain names"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Internal Proxy","attck_id":"T1090.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["HTTP requests contain Base64 strings"],"parent":null},{"tactic":"Command and Control","technique":"Standard Encoding","attck_id":"T1132.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1132/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["HTTP request contains Base64 encoded artifacts"],"parent":{"technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132"}},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attck_id":"T1568.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1568/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["High entropy domain detected"],"parent":{"technique":"Dynamic Resolution","attck_id":"T1568","attck_id_wiki":"https://attack.mitre.org/techniques/T1568"}},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attck_id":"T1041","attck_id_wiki":"https://attack.mitre.org/techniques/T1041","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["POSTs data to a webserver"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to terminate a process (API string)"],"parent":null},{"tactic":"Impact","technique":"Disk Content Wipe","attck_id":"T1561.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1561/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to format disks"],"parent":{"technique":"Disk Wipe","attck_id":"T1561","attck_id_wiki":"https://attack.mitre.org/techniques/T1561"}},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to shutdown system"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Able to inject code into another process (API string)","description":"$26","description_v2":["Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"$27","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"129\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"133\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"137\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"138\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"139\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"136\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"135\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"134\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"140\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"141\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"142\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"143\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"144\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"145\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"132\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"2\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"3\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"4\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"5\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"6\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"9\" - (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"10\" - (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"129\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"133\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"137\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"138\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"139\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"136\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"135\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"134\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"140\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"141\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"142\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"143\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"144\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"145\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"132\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"2\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"3\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"4\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"5\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"6\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"9\" - (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"FindResourceW\" with parameter \"10\" - (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"$28","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059312'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059352'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059512'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059552'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059592'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059472'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059432'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059392'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059632'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059672'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059712'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059752'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059792'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059832'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059896'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058248'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058288'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058328'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058368'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058408'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058448'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058488'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058528'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058568'}\" (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058608'}\" (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059312'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059352'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059512'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059552'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059592'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059472'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059432'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059392'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059632'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059672'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059712'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059752'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059792'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059832'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6059896'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058248'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058288'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058328'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058368'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058408'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058448'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058488'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058528'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058568'}\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '6058608'}\" (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","description_v2":["Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$2a","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$2b","description_v2":["Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"memorydump-8","type":20,"relevance":1,"name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found PE header \"MZ\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","description_v2":["Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"$2c","description_v2":["\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404103584 [PID: 5040]","\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404111582 [PID: 5040]","\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404283100 [PID: 5040]","\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404291926 [PID: 5040]","\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3405811666 [PID: 5040]","\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3405821067 [PID: 5040]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408310518 [PID: 6884]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408319344 [PID: 6884]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408860251 [PID: 6884]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408874764 [PID: 6884]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3409147004 [PID: 6884]","\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3409154445 [PID: 6884]"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404103584 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404111582 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404283100 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3404291926 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3405811666 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queried SystemProcessInformation at 00000000-00005040-00000C15-3405821067 [PID: 5040]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408310518 [PID: 6884]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408319344 [PID: 6884]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408860251 [PID: 6884]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3408874764 [PID: 6884]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3409147004 [PID: 6884]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" queried SystemProcessInformation at 00000000-00006884-00000C15-3409154445 [PID: 6884]"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-4","type":1,"relevance":1,"name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-2729-0044EA38\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-3312-004343D1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-5008-0043422E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-8441-0043437C","description_v2":["SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-2729-0044EA38","SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-3312-004343D1","SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-5008-0043422E","SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005040-47000-8441-0043437C"],"description_v3":[{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2729-0044EA38","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2729-0044EA38","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-5008-0043422E","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5008-0043422E","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2729-0044EA38","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-41","type":1,"relevance":10,"name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SetThreadGroupAffinity@KERNEL32.DLL at 00000000-00005040-47000-2914-004360AB\n Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["Found reference to API SetThreadGroupAffinity@KERNEL32.DLL at 00000000-00005040-47000-2914-004360AB","Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"Found reference to API SetThreadGroupAffinity@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2914-004360AB","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2914-004360AB","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"Found reference to API FlsAlloc@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2914-004360AB","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","description_v2":["Raw size of \"UPX0\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \"UPX0\" is zero"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"stream-139","type":1,"relevance":0,"name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","description_v2":["Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2722-0046A820","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2722-0046A820","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38","Assembly shows XOR instruction xor byte ptr [edi+14h]","ah in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor byte ptr [ebx+14h]","al in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor byte ptr [eax+14h]","bl in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor byte ptr [edx+14h]","dl in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor al","ah in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor byte ptr [ebp-26h]","73h in Stream UID: 00000000-00005040-47000-2732-0046C36A","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2746-0045A188","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2746-0045A188","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE","Assembly shows XOR instruction xor esi","eax in Stream UID: 00000000-00005040-47000-2769-0045F5D4","Assembly shows XOR instruction xor edi","edx in Stream UID: 00000000-00005040-47000-2769-0045F5D4","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2773-0045F878","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2773-0045F878","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2777-00467E37","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2777-00467E37","Assembly shows XOR instruction xor eax","dword ptr [ecx+08h] in Stream UID: 00000000-00005040-47000-2786-0045EFE4","Assembly shows XOR instruction xor dword ptr [ecx+08h]","eax in Stream UID: 00000000-00005040-47000-2786-0045EFE4","Assembly shows XOR instruction xor ecx","dword ptr [eax] in Stream UID: 00000000-00005040-47000-2786-0045EFE4","Assembly shows XOR instruction xor dword ptr [eax]","ecx in Stream UID: 00000000-00005040-47000-2786-0045EFE4","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2908-00436786","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2908-00436786","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-2911-0043A370","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-2911-0043A370","Assembly shows XOR instruction xor esi","dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2927-00432530","Assembly shows XOR instruction xor esi","dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2944-00436457","Assembly shows XOR instruction xor esi","eax in Stream UID: 00000000-00005040-47000-2975-00432575","Assembly shows XOR instruction xor esi","dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3027-004326E9","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3062-0045A542","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3062-0045A542","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03","Assembly shows XOR instruction xor esi","eax in Stream UID: 00000000-00005040-47000-3125-0044DD1B","Assembly shows XOR instruction xor edi","edx in Stream UID: 00000000-00005040-47000-3125-0044DD1B","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3233-00463769","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3233-00463769","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3256-004633E4","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3256-004633E4","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F","Assembly shows XOR instruction xor eax","dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3268-0045F50E"],"description_v3":[{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2722-0046A820"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2722-0046A820"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2729-0044EA38"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [edi+14h]"},{"type":"linebreak"},{"type":"text","value":"ah in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [ebx+14h]"},{"type":"linebreak"},{"type":"text","value":"al in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [eax+14h]"},{"type":"linebreak"},{"type":"text","value":"bl in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [edx+14h]"},{"type":"linebreak"},{"type":"text","value":"dl in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor al"},{"type":"linebreak"},{"type":"text","value":"ah in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [ebp-26h]"},{"type":"linebreak"},{"type":"text","value":"73h in Stream UID: 00000000-00005040-47000-2732-0046C36A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2746-0045A188"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2746-0045A188"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2768-0045F8CE"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00005040-47000-2769-0045F5D4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor edi"},{"type":"linebreak"},{"type":"text","value":"edx in Stream UID: 00000000-00005040-47000-2769-0045F5D4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2773-0045F878"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2773-0045F878"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2777-00467E37"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2777-00467E37"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"dword ptr [ecx+08h] in Stream UID: 00000000-00005040-47000-2786-0045EFE4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor dword ptr [ecx+08h]"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00005040-47000-2786-0045EFE4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"dword ptr [eax] in Stream UID: 00000000-00005040-47000-2786-0045EFE4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor dword ptr [eax]"},{"type":"linebreak"},{"type":"text","value":"ecx in Stream UID: 00000000-00005040-47000-2786-0045EFE4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2908-00436786"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2908-00436786"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2911-0043A370"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-2911-0043A370"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2927-00432530"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-2944-00436457"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00005040-47000-2975-00432575"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3027-004326E9"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3062-0045A542"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3062-0045A542"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3111-0046CB03"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor esi"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00005040-47000-3125-0044DD1B"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor edi"},{"type":"linebreak"},{"type":"text","value":"edx in Stream UID: 00000000-00005040-47000-3125-0044DD1B"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3233-00463769"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3233-00463769"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3256-004633E4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3256-004633E4"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3259-0045B8D3"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3262-0045FAD9"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3263-0045FC05"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00005040-47000-3266-0045F75F"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"dword ptr [00494B64h] in Stream UID: 00000000-00005040-47000-3268-0045F50E"}],"origin":"Hybrid Analysis Technology","attck_id":"T1027.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-106","type":2,"relevance":1,"name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","description_v2":["Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-624","type":2,"relevance":1,"name":"Found XOR operators (encryption/decryption)","description":"Found string \"X ^ d j p v |\" (Indicator: \" ^ \"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")","description_v2":["Found string \"X ^ d j p v |\" (Indicator: \" ^ \"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"X ^ d j p v |\" (Indicator: \" ^ \"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"network-60","type":7,"relevance":1,"name":"HTTP requests contain Base64 strings","description":"$2e","description_v2":["Contains base64 string in header \"/components/webinstaller\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"Encoding\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"gzip\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"MSIE\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"NET4\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"InfoPath\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"Host\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"Keep\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\"","Contains base64 string in header \"POST\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"1Content\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"Type\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"application/jsonUser\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"7376\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"Host\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"insights\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"Keep\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\"","Contains base64 string in header \"Keep\" in header \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1Host: content-system.gog.comConnection: Keep-Alive\""],"description_v3":[{"type":"text","value":"Contains base64 string in header \"/components/webinstaller\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Encoding\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"gzip\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"MSIE\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"NET4\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"InfoPath\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Host\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Keep\" in header \"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: remote-config.gog.comConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"POST\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"1Content\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Type\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"application/jsonUser\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"7376\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Host\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"insights\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Keep\" in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Keep\" in header \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1Host: content-system.gog.comConnection: Keep-Alive\""}],"origin":"Network Traffic","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"binary-71","type":8,"relevance":1,"name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.07477","description_v2":["Sample file \"sample.bin\" has high entropy 7.07477"],"description_v3":[{"type":"text","value":"Sample file \"sample.bin\" has high entropy 7.07477"}],"origin":"Binary File","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","Matched sigs: Found XOR operators (encryption/decryption)","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: HTTP requests contain Base64 strings","Matched sigs: HTTP request contains Base64 encoded artifacts","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found XOR operators (encryption/decryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP requests contain Base64 strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP request contains Base64 encoded artifacts"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$2f","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Decrypted SSL network traffic","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to decode base64 data","Matched sigs: Found XOR operators (encryption/decryption)","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Calls an API typically used to decrypt a block of data","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Calls an API typically used to encrypt a block of data","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: HTTP requests contain Base64 strings","Matched sigs: HTTP request contains Base64 encoded artifacts","Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Decrypted SSL network traffic"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found XOR operators (encryption/decryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to encrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP requests contain Base64 strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP request contains Base64 encoded artifacts"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Sample file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"binary-92","type":8,"relevance":0,"name":"XOR operations in executable file detected","description":"$30","description_v2":["Found XOR loop in file \"sample.bin\" at offset 119396; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 148566; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 150146; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 158219; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 186899; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 201428; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 397253; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 414576; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 874393; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 31140; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 39248; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 58493; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 129667; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 199909; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 278552; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 335814; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 359695; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 378532; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 400978; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 729593; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 808353; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 1110; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 39789; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 57264; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 126855; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 130514; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 147043; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 156266; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 166111; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 186261; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 191382; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 217196; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 233437; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 270178; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 380164; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 947090; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 972091; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 973923; code bytes = 8030"],"description_v3":[{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 119396; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 148566; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 150146; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 158219; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 186899; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 201428; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 397253; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 414576; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 874393; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 31140; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 39248; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 58493; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 129667; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 199909; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 278552; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 335814; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 359695; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 378532; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 400978; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 729593; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 808353; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1110; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 39789; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 57264; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 126855; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 130514; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 147043; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 156266; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 166111; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 186261; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 191382; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 217196; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 233437; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 270178; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 380164; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 947090; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 972091; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 973923; code bytes = 8030"}],"origin":"Binary File","attck_id":"T1027.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-937","type":2,"relevance":1,"name":"Able to gather system information (.NET)","description":"$31","description_v2":["Found string \"System.Identity.UserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.UserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"get_UserName\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"GetDrives\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"ystem.Identity.UserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"ystem.UserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"get_UserName\" (Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found string \"GetDrives\" (Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"System.Identity.UserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.UserName\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"get_UserName\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetDrives\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Identity.UserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.UserName\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"get_UserName\" (Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetDrives\" (Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Able to query system locale information (API string)","description":"$32","description_v2":["Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-901","type":2,"relevance":1,"name":"Able to retrieve date formats supported by the local system (API string)","description":"$33","description_v2":["Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006884-00000C2B-3408667745\")","description_v2":["Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006884-00000C2B-3408667745\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006884-00000C2B-3408667745\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","description_v2":["Found system information discovery API: \"GetEnvironmentStringsW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""],"description_v3":[{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173189\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173211\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177424\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177450\")","description_v2":["Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173189\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173211\")","Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177424\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177450\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173189\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00006884-00000C2B-3410173211\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177424\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00006884-00000C2B-3410177450\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"GalaxyInstaller.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006884)","description_v2":["\"GalaxyInstaller.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"GOG_Galaxy_2.0.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005040)\n \"GOG_Galaxy_2.0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005040)\n \"GalaxyInstaller.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00006884)\n \"GalaxyInstaller.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006884)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005040)","\"GalaxyInstaller.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"GOG_Galaxy_2.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"GOG_Galaxy_2.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"GOG Galaxy Web Installer\" - (UID: 00000000-00006884)\n \"GalaxyInstaller.exe\" called \"GetWindowTextW\" (UID: 00000000-00006884)\n \"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"Downloading GOG Galaxy - 0 MB of 0 MB\" - (UID: 00000000-00006884)","description_v2":["\"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"GOG Galaxy Web Installer\" - (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetWindowTextW\" (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"Downloading GOG Galaxy - 0 MB of 0 MB\" - (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"GOG Galaxy Web Installer\" - (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetWindowTextW\" (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetWindowTextW\" with parameter \"Downloading GOG Galaxy - 0 MB of 0 MB\" - (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-150","type":6,"relevance":5,"name":"Calls an API typically used to get handle of currently active window","description":"\"GalaxyInstaller.exe\" called \"GetActiveWindow\" (UID: 00000000-00006884)","description_v2":["\"GalaxyInstaller.exe\" called \"GetActiveWindow\" (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetActiveWindow\" (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"GOG_Galaxy_2.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$34","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-144","type":6,"relevance":3,"name":"Calls an API typically used to open an existing named mutex object","description":"\"GOG_Galaxy_2.0.exe\" called \"OpenMutexW\" with parameter \"GOG-WEBINSTALLERMUTEX\" - (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"OpenMutexW\" with parameter \"GOG-WEBINSTALLERMUTEX\" - (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"OpenMutexW\" with parameter \"GOG-WEBINSTALLERMUTEX\" - (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-87","type":1,"relevance":3,"name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005040-47000-2944-00436457\n GetTickCount64@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["GetTickCount@KERNEL32.DLL at 00000000-00005040-47000-2944-00436457","GetTickCount64@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"GetTickCount@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetTickCount64@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-89","type":1,"relevance":3,"name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.DLL at 00000000-00005040-47000-5657-004641F2","description_v2":["FindFirstFileExA@KERNEL32.DLL at 00000000-00005040-47000-5657-004641F2"],"description_v3":[{"type":"text","value":"FindFirstFileExA@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-5657-004641F2","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5657-004641F2","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5657-004641F2","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-71","type":1,"relevance":1,"name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-3799-0043267D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-4724-0045FA13\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-5020-004345D0","description_v2":["GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-3799-0043267D","GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-4724-0045FA13","GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-5020-004345D0"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-5020-004345D0","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5020-004345D0","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5020-004345D0","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-3799-0043267D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-4724-0045FA13\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-5020-004345D0\n GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-3799-0043267D","GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-4724-0045FA13","GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-5020-004345D0","GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-5020-004345D0","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5020-004345D0","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimePreciseAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5020-004345D0","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-48","type":1,"relevance":1,"name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005040-47000-4704-00462779\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005040-47000-4718-0041DF18","description_v2":["GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005040-47000-4704-00462779","GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005040-47000-4718-0041DF18"],"description_v3":[{"type":"text","value":"GetTimeZoneInformation@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4704-00462779","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4704-00462779","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetTimeZoneInformation@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4704-00462779","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-3","type":1,"relevance":1,"name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00005040-47000-2911-0043A370","description_v2":["GetVersionExW@KERNEL32.DLL at 00000000-00005040-47000-2911-0043A370"],"description_v3":[{"type":"text","value":"GetVersionExW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-49","type":1,"relevance":1,"name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005040-47000-3262-0045FAD9\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3268-0045F50E\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3275-0045F9A9\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005040-47000-3299-004671B9\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3300-00466AF9\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3301-00466BDF\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3303-00466FE5\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3304-00466B44\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3417-0043294C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5712-00466A52\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5715-00466C6E\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5716-004670EC\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5717-00466EBE\n GetLocaleInfoEx@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005040-47000-3262-0045FAD9","EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3268-0045F50E","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3275-0045F9A9","GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005040-47000-3299-004671B9","EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3300-00466AF9","EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3301-00466BDF","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3303-00466FE5","EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005040-47000-3304-00466B44","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-3417-0043294C","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5712-00466A52","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5715-00466C6E","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5716-004670EC","GetLocaleInfoW@KERNEL32.DLL at 00000000-00005040-47000-5717-00466EBE","GetLocaleInfoEx@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3299-004671B9","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3299-004671B9","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3303-00466FE5","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3303-00466FE5","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoEx@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3299-004671B9","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"79882320378,1288,109,,GetWindowTextW,user32.dll,\"01:13:58.843\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")\n Found reference to API \"151995108379,1288,109,,GetWindowTextW,user32.dll,\"01:14:28.890\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")\n Found reference to API \"424519334793,1288,109,,GetWindowTextW,user32.dll,\"01:16:22.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")","description_v2":["Found reference to API \"79882320378,1288,109,,GetWindowTextW,user32.dll,\"01:13:58.843\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found reference to API \"151995108379,1288,109,,GetWindowTextW,user32.dll,\"01:14:28.890\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found reference to API \"424519334793,1288,109,,GetWindowTextW,user32.dll,\"01:16:22.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"79882320378,1288,109,,GetWindowTextW,user32.dll,\"01:13:58.843\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"151995108379,1288,109,,GetWindowTextW,user32.dll,\"01:14:28.890\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"424519334793,1288,109,,GetWindowTextW,user32.dll,\"01:16:22.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006884.00000003.293281.214E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-79","type":1,"relevance":3,"name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4347-00414777\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4349-00415488\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4350-00414579\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4351-00414396\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4744-0041E1C6\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4766-0041468C\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4767-00414862","description_v2":["GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4347-00414777","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4349-00415488","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4350-00414579","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4351-00414396","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4744-0041E1C6","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4766-0041468C","GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005040-47000-4767-00414862"],"description_v3":[{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4347-00414777","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4347-00414777","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4350-00414579","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4350-00414579","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4351-00414396","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4351-00414396","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4744-0041E1C6","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4744-0041E1C6","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4766-0041468C","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4766-0041468C","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultUILanguage@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4767-00414862","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4767-00414862","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4347-00414777","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"$35","description_v2":["Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-31","type":1,"relevance":1,"name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00005040-47000-8368-0046311C","description_v2":["GetProcessHeap@KERNEL32.DLL at 00000000-00005040-47000-8368-0046311C"],"description_v3":[{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-124","type":1,"relevance":1,"name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-3872-00407E84\n PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4354-00414EA3\n PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4744-0041E1C6\n PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4772-004139C5","description_v2":["PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-3872-00407E84","PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4354-00414EA3","PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4744-0041E1C6","PathFileExistsW@SHLWAPI.DLL at 00000000-00005040-47000-4772-004139C5"],"description_v3":[{"type":"text","value":"PathFileExistsW@SHLWAPI.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3872-00407E84","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3872-00407E84","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"PathFileExistsW@SHLWAPI.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4354-00414EA3","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4354-00414EA3","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"PathFileExistsW@SHLWAPI.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4744-0041E1C6","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4744-0041E1C6","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"PathFileExistsW@SHLWAPI.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4772-004139C5","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4772-004139C5","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3872-00407E84","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-140","type":2,"relevance":1,"name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-39","type":1,"relevance":10,"name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 004628A5h\" at 00000000-00005040-47000-4704-00462779\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"jne 0041DF6Bh\" at 00000000-00005040-47000-4718-0041DF18","description_v2":["Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 004628A5h\" at 00000000-00005040-47000-4704-00462779","Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"jne 0041DF6Bh\" at 00000000-00005040-47000-4718-0041DF18"],"description_v3":[{"type":"text","value":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 004628A5h\""},{"type":"stream","stream_uid":"00000000-00005040-47000-4704-00462779","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4704-00462779","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"jne 0041DF6Bh\""},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4704-00462779","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-130","type":3,"relevance":1,"name":"Queries TCP/IP interface details","description":"$36","description_v2":["\"GalaxyInstaller.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"REGISTRATIONENABLED\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"REGISTERADAPTERNAME\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DOMAIN\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DHCPDOMAIN\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"REGISTRATIONENABLED\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"REGISTERADAPTERNAME\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"DOMAIN\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"DHCPDOMAIN\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"SEARCHLIST\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"NAMESERVER\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"PROFILENAMESERVER\"; Value: \"\")","\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DHCPNAMESERVER\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"REGISTRATIONENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"REGISTERADAPTERNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DOMAIN\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DHCPDOMAIN\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"REGISTRATIONENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"REGISTERADAPTERNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"DOMAIN\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"DHCPDOMAIN\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"SEARCHLIST\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"NAMESERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"PROFILENAMESERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"DHCPNAMESERVER\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GALAXYINSTALLER.EXE\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GALAXYINSTALLER.EXE\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GALAXYINSTALLER.EXE\")"}],"origin":"Registry Access","attck_id":"T1518","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-884","type":2,"relevance":1,"name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-930","type":2,"relevance":1,"name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found string \"GetCommandLineA\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"GetCommandLineW\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineA\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$37","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$38","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\104C63D2546B8021DD105E9FBA5A8D78169F6B32\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\247106A405B288A46E70A0262717162D0903E734\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\4C27431717565A3A07F3E6D0032C4258949CF9EC\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D\"; Key: \"BLOB\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7\"; Key: \"BLOB\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\104C63D2546B8021DD105E9FBA5A8D78169F6B32\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\247106A405B288A46E70A0262717162D0903E734\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\4C27431717565A3A07F3E6D0032C4258949CF9EC\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7\"; Key: \"BLOB\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"$39","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter 43003a00 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter C:/ProgramData (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs/ (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pt-BR (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\fr (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\de (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pl (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ru (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh-Hant (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ja (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ko (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es-MX (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\it (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter 43003a00 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\(UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs/ (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pt-BR (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\fr (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\de (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pl (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ru (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh-Hant (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ja (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ko (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es-MX (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\it (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-128","type":6,"relevance":5,"name":"Calls an API typically used to create a process","description":"\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-138","type":6,"relevance":3,"name":"Calls an API typically used to create an instance of a named pipe","description":"\"GalaxyInstaller.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a\" - (UID: 00000000-00006884)","description_v2":["\"GalaxyInstaller.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a\" - (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a\" - (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$3a","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter KERNEL32.DLL (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00005040)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter KERNEL32.DLL (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter WS2_32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"LoadLibrary\" with a parameter comctl32.dll (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$3b","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VerSetConditionMask (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VerifyVersionInfoW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MapViewOfFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter OpenMutexW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapSize (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CopyFileW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LockResource (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadResource (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SizeofResource (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindResourceW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEndOfFile (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReadConsoleW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObjectEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetExitCodeThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TryEnterCriticalSection (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsAlloc (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsGetValue (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsSetValue (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsFree (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CompareStringW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LCMapStringW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStringTypeW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCPInfo (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ResetEvent (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsDebuggerPresent (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnhandledExceptionFilter (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStartupInfoW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeSListHead (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateTimerQueue (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SignalObjectAndWait (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SwitchToThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadPriority (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetThreadPriority (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateTimerQueueTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ChangeTimerQueueTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteTimerQueueTimer (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcessAffinityMask (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadAffinityMask (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnregisterWait (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetThreadTimes (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibraryAndExitThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetVersionExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualAlloc (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualFree (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualProtect (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseSemaphore (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedPopEntrySList (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedPushEntrySList (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedFlushSList (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter QueryDepthSList (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnregisterWaitEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadLibraryW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RtlUnwind (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapAlloc (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapReAlloc (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ExitThread (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapFree (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ExitProcess (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetDateFormatW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTimeFormatW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsValidLocale (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLCID (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EnumSystemLocalesW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetStdHandle (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFilePointerEx (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcessHeap (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindFirstFileExA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindNextFileA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsValidCodePage (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetOEMCP (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCommandLineA (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentStringsW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ShellExecuteExW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SHFileOperationW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter PathFileExistsW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter URLDownloadToFileW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MessageBoxW (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00005040)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ResetEvent (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetNetworkParams (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetAddrInfoW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetAdaptersAddresses (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSAConnect (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeContextBuffer (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeCredentialsHandle (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteSecurityContext (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeSecurityContextW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter QueryContextAttributesW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStore (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStoreW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateChain (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertOpenStore (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertOpenStoreW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChain (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChainW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EncryptMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DecryptMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoRegisterMessageFilter (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PeekMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PeekMessageW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowUnicode (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetMessageW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter TranslateMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DispatchMessageW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PostMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PostMessageW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowText (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowTextW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetStartupInfo (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetStartupInfoW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SendMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SendMessageW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemMenu (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowPlacement (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnableMenuItem (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClientRect (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLength (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLengthW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemMetrics (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowText (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowPos (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RedrawWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ShowWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClassInfo (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClassInfoW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSARecv (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MapWindowPoints (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetFocus (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetNearestColor (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSolidBrush (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FillRect (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RestoreDC (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InvalidateRect (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter BeginPaint (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateHalftonePalette (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectPalette (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EndPaint (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateCompatibleDC (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetObjectType (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateCompatibleBitmap (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDIBits (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteObject (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateDIBSection (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectObject (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipTranslateWorldTransform (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipSetClipRectI (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateMatrix (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetWorldTransform (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipIsMatrixIdentity (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetMatrixElements (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipDeleteMatrix (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateRegion (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetClip (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipIsInfiniteRegion (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipSaveGraphics (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCombineRegionRegion (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetRegionHRgn (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipDeleteRegion (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetDC (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateRectRgn (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClipRgn (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectClipRgn (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter OffsetViewportOrgEx (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipReleaseDC (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipRestoreGraphics (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfo (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetTextRenderingHint (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter BitBlt (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteDC (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WaitMessage (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetMessageA (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DispatchMessageA (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDlgItem (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTextAlign (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTextColor (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetBkMode (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetBkMode (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetExitCodeThread (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LoadCursor (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LoadCursorW (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetCursor (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter _TrackMouseEvent (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetKeyState (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformation (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationA (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumThreadWindows (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowVisible (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowEnabled (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetActiveWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetFocus (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnableWindow (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MessageBox (UID: 00000000-00006884)","\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MessageBoxW (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VerSetConditionMask (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VerifyVersionInfoW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MapViewOfFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter OpenMutexW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapSize (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CopyFileW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LockResource (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadResource (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SizeofResource (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindResourceW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEndOfFile (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReadConsoleW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObjectEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetExitCodeThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TryEnterCriticalSection (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsAlloc (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsGetValue (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsSetValue (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TlsFree (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CompareStringW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LCMapStringW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStringTypeW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCPInfo (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ResetEvent (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsDebuggerPresent (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnhandledExceptionFilter (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStartupInfoW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InitializeSListHead (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateTimerQueue (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SignalObjectAndWait (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SwitchToThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadPriority (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetThreadPriority (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter CreateTimerQueueTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ChangeTimerQueueTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteTimerQueueTimer (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcessAffinityMask (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetThreadAffinityMask (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnregisterWait (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetThreadTimes (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FreeLibraryAndExitThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetVersionExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualAlloc (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualFree (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter VirtualProtect (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ReleaseSemaphore (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedPopEntrySList (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedPushEntrySList (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter InterlockedFlushSList (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter QueryDepthSList (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter UnregisterWaitEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter LoadLibraryW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RtlUnwind (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapAlloc (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapReAlloc (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ExitThread (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter HeapFree (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ExitProcess (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetDateFormatW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetTimeFormatW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsValidLocale (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLCID (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter EnumSystemLocalesW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetStdHandle (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SetFilePointerEx (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetProcessHeap (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindFirstFileExA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter FindNextFileA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter IsValidCodePage (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetOEMCP (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCommandLineA (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentStringsW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter ShellExecuteExW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter SHFileOperationW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter PathFileExistsW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter URLDownloadToFileW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter MessageBoxW (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ResetEvent (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetNetworkParams (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetAddrInfoW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetAdaptersAddresses (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSAConnect (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeContextBuffer (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FreeCredentialsHandle (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteSecurityContext (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitializeSecurityContextW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter QueryContextAttributesW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStore (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStoreW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateChain (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertOpenStore (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertOpenStoreW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChain (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChainW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EncryptMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DecryptMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CoRegisterMessageFilter (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PeekMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PeekMessageW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowUnicode (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetMessageW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter TranslateMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DispatchMessageW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PostMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter PostMessageW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowText (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowTextW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetStartupInfo (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetStartupInfoW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SendMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SendMessageW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemMenu (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowPlacement (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnableMenuItem (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClientRect (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLength (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextLengthW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetSystemMetrics (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowText (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowTextW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetWindowPos (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RedrawWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter ShowWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClassInfo (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClassInfoW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WSARecv (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MapWindowPoints (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetFocus (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetNearestColor (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateSolidBrush (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter FillRect (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter RestoreDC (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter InvalidateRect (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter BeginPaint (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateHalftonePalette (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectPalette (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EndPaint (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateCompatibleDC (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetObjectType (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateCompatibleBitmap (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDIBits (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteObject (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateDIBSection (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectObject (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipTranslateWorldTransform (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipSetClipRectI (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateMatrix (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetWorldTransform (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipIsMatrixIdentity (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetMatrixElements (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipDeleteMatrix (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCreateRegion (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetClip (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipIsInfiniteRegion (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipSaveGraphics (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipCombineRegionRegion (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetRegionHRgn (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipDeleteRegion (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetDC (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter CreateRectRgn (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetClipRgn (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SelectClipRgn (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter OffsetViewportOrgEx (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipReleaseDC (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipRestoreGraphics (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfo (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GdipGetTextRenderingHint (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter BitBlt (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DeleteDC (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter WaitMessage (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetMessageA (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter DispatchMessageA (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetDlgItem (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTextAlign (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetTextColor (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetBkMode (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetBkMode (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetExitCodeThread (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LoadCursor (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter LoadCursorW (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter SetCursor (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter _TrackMouseEvent (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetKeyState (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformation (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationA (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnumThreadWindows (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowVisible (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindowEnabled (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetActiveWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter GetFocus (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter IsWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter EnableWindow (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MessageBox (UID: 00000000-00006884)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetProcAddress\" with a parameter MessageBoxW (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"remote-config.gog.com\"\n \"insights-collector.gog.com\"\n \"content-system.gog.com\"","description_v2":["\"remote-config.gog.com\"","\"insights-collector.gog.com\"","\"content-system.gog.com\""],"description_v3":[{"type":"text","value":"\"remote-config.gog.com\""},{"type":"linebreak"},{"type":"text","value":"\"insights-collector.gog.com\""},{"type":"linebreak"},{"type":"text","value":"\"content-system.gog.com\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"151.101.1.55:443\"\n \"151.101.65.55:443\"","description_v2":["\"151.101.1.55:443\"","\"151.101.65.55:443\""],"description_v3":[{"type":"text","value":"\"151.101.1.55:443\""},{"type":"linebreak"},{"type":"text","value":"\"151.101.65.55:443\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"XY;.pdb\"","description_v2":["\"XY;.pdb\""],"description_v3":[{"type":"text","value":"\"XY;.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFile failed with error {}\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-103","type":1,"relevance":3,"name":"Contains ability to delay the execution of current thread","description":"$3c","description_v2":["Sleep@KERNEL32.DLL at 00000000-00005040-47000-2839-00436565","RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-2905-00436471","RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-3031-0043ACF4","CreateTimerQueueTimer@KERNEL32.DLL at 00000000-00005040-47000-3035-004361F7","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-3831-0043370E","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-4252-004207AB","Sleep@KERNEL32.DLL at 00000000-00005040-47000-4261-0041D88F","Sleep@KERNEL32.DLL at 00000000-00005040-47000-4262-00420827","Sleep@KERNEL32.DLL at 00000000-00005040-47000-4511-0041C230","WaitForSingleObject@KERNEL32.DLL at 00000000-00005040-47000-4748-00414A26","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5057-0043662A","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5133-00438266","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5289-0043E506","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5528-00448C97","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-5536-00448CB3","WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005040-47000-8478-004475B3"],"description_v3":[{"type":"text","value":"Sleep@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"RegisterWaitForSingleObject@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"RegisterWaitForSingleObject@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3031-0043ACF4","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3031-0043ACF4","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"CreateTimerQueueTimer@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"Sleep@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"Sleep@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"Sleep@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4511-0041C230","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4511-0041C230","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObject@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4748-00414A26","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4748-00414A26","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObjectEx@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3031-0043ACF4","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: GOG_Galaxy_2.0.exe)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: GOG_Galaxy_2.0.exe)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: GOG_Galaxy_2.0.exe)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-108","type":1,"relevance":3,"name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2771-0045F670\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2913-004424F7\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-3046-00442AF5\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-3126-0044DDBB","description_v2":["LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2771-0045F670","LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786","LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-2913-004424F7","LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-3046-00442AF5","LoadLibraryExW@KERNEL32.DLL at 00000000-00005040-47000-3126-0044DDBB"],"description_v3":[{"type":"text","value":"LoadLibraryExW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2908-00436786","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2913-004424F7","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2913-004424F7","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3046-00442AF5","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3046-00442AF5","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$3d","description_v2":["Found reference to API (Indicator: \"RegCloseKey\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"VirtualProtect\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"ShellExecuteExW\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"PathFileExistsW\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"MessageBoxW\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"URLDownloadToFileW\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API (Indicator: \"FlsSetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsGetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadGroupAffinity\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadGroupAffinity\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessorNumberEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLogicalProcessorInformationEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCMapStringEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CompareStringEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableCS\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitOnceExecuteOnce\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateEventExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForThreadpoolTimerCallbacks\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlushProcessWriteBuffers\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibraryWhenCallbackReturns\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessorNumber\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTickCount64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeSRWLock\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SubmitThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadIcon\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MessageBox\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReleaseMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"Sleep\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFilePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateMutexW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"OpenMutexW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapSize\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CopyFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LockResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SizeofResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindResourceW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEnvironmentVariableA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEndOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReadConsoleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DuplicateHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TryEnterCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CompareStringW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCMapStringW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStringTypeW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCPInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEvent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ResetEvent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateTimerQueue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SignalObjectAndWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SwitchToThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadPriority\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadPriority\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ChangeTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadAffinityMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnregisterWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadTimes\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VirtualAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VirtualFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedPopEntrySList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedPushEntrySList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"QueryDepthSList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnregisterWaitEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadLibraryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RtlUnwind\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MoveFileExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ExitThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetACP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetDateFormatW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidLocale\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetConsoleCP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetStdHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindClose\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindFirstFileExA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindNextFileA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidCodePage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetOEMCP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCommandLineA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SHFileOperationW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitOnceExecuteOnce\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateEventExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForThreadpoolTimerCallbacks\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlushProcessWriteBuffers\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibraryWhenCallbackReturns\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessorNumber\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTickCount64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WakeConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeSRWLock\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableSRW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SubmitThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadGroupAffinity\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadGroupAffinity\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessorNumberEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLogicalProcessorInformationEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadIcon\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"OpenMutexW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEnvironmentVariableA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCurrentThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateTimerQueue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SignalObjectAndWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SwitchToThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadPriority\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadPriority\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ChangeTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetProcessAffinityMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetThreadAffinityMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnregisterWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetThreadTimes\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedPopEntrySList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedPushEntrySList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"InterlockedFlushSList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"QueryDepthSList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"UnregisterWaitEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetConsoleCP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindFirstFileExA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"FindNextFileA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"ShellExecuteExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"SHFileOperationW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API (Indicator: \"PathFileExistsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"URLDownloadToFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadIcon\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteExW\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathFileExistsW\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"URLDownloadToFileW\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadGroupAffinity\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadGroupAffinity\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessorNumberEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalProcessorInformationEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableCS\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceExecuteOnce\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForThreadpoolTimerCallbacks\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushProcessWriteBuffers\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryWhenCallbackReturns\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessorNumber\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeConditionVariable\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSRWLock\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SubmitThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolWork\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadIcon\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenMutexW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryEnterCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateTimerQueue\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SignalObjectAndWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SwitchToThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadPriority\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadPriority\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ChangeTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteTimerQueueTimer\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadAffinityMask\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWait\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadTimes\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPopEntrySList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPushEntrySList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryDepthSList\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWaitEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleCP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHFileOperationW\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceExecuteOnce\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForThreadpoolTimerCallbacks\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushProcessWriteBuffers\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryWhenCallbackReturns\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessorNumber\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSRWLock\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableSRW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SubmitThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseThreadpoolWork\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadGroupAffinity\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadGroupAffinity\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessorNumberEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalProcessorInformationEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadIcon\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenMutexW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateTimerQueue\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SignalObjectAndWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SwitchToThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadPriority\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadPriority\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalProcessorInformation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ChangeTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteTimerQueueTimer\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessAffinityMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadAffinityMask\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWait\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadTimes\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPopEntrySList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPushEntrySList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedFlushSList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryDepthSList\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWaitEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleCP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteExW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHFileOperationW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathFileExistsW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"URLDownloadToFileW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadIcon\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectory\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")\n Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteEx failed. Error code {}.\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"$3e","description_v2":["Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"$3f","description_v2":["Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-269","type":2,"relevance":1,"name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$40","description_v2":["\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 47000-3872-00407E84","\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 47000-3872-00407E84","\"Software\\GOG.com\\GalaxyClient\" in Source: 47000-3872-00407E84","\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 47000-3872-00407E84","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 47000-3895-00408152","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 47000-3896-0040818B","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","00000000-00005040.00000001.283921.029F0000.00000004.mdmp","00000000-00005040.00000002.285843.029F0000.00000004.mdmp","00000000-00005040.00000003.293266.029F0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","00000000-00005040.00000001.283921.029F0000.00000004.mdmp","00000000-00005040.00000002.285843.029F0000.00000004.mdmp","00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","00000000-00005040.00000001.283921.029F0000.00000004.mdmp","00000000-00005040.00000002.285843.029F0000.00000004.mdmp","00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","00000000-00005040.00000001.283921.029F0000.00000004.mdmp","00000000-00005040.00000002.285843.029F0000.00000004.mdmp","00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"stry\\Machine\\Software\\Classes\\Applications\\%1.exe\" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","00000000-00006884.00000001.284132.02D00000.00000004.mdmp","00000000-00006884.00000002.286051.02D00000.00000004.mdmp","00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","00000000-00006884.00000001.284132.02D00000.00000004.mdmp","00000000-00006884.00000002.286051.02D00000.00000004.mdmp","00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","00000000-00006884.00000001.284132.02D00000.00000004.mdmp","00000000-00006884.00000002.286051.02D00000.00000004.mdmp","00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp","00000000-00006884.00000001.284132.1EC90000.00000004.mdmp","00000000-00006884.00000002.286051.1EC90000.00000004.mdmp","00000000-00006884.00000003.293281.1EC90000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp","00000000-00006884.00000001.284132.214E0000.00000004.mdmp","00000000-00006884.00000002.286051.214E0000.00000004.mdmp","00000000-00006884.00000003.293281.02D00000.00000004.mdmp","00000000-00006884.00000003.293281.214E0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp","00000000-00006884.00000001.284132.214E0000.00000004.mdmp","00000000-00006884.00000002.286051.214E0000.00000004.mdmp","00000000-00006884.00000003.293281.1EC90000.00000004.mdmp","00000000-00006884.00000003.293281.214E0000.00000004.mdmp","\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp","00000000-00006884.00000002.286051.A4000000.00000004.mdmp","00000000-00006884.00000003.293281.A4000000.00000004.mdmp","\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp","00000000-00006884.00000002.286051.A4000000.00000004.mdmp","00000000-00006884.00000003.293281.A4000000.00000004.mdmp","\"\\Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 47000-3872-00407E84"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 47000-3872-00407E84"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\" in Source: 47000-3872-00407E84"},{"type":"linebreak"},{"type":"text","value":"\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 47000-3872-00407E84"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 47000-3895-00408152"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 47000-3896-0040818B"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000003.293266.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=%ALLUSERSPROFILE%\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\Applications\\%1.exe\" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000001.284132.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000002.286051.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006884.00000003.293281.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-318","type":6,"relevance":3,"name":"Creates directory on disk","description":"$41","description_v2":["\"GOG_Galaxy_2.0.exe\" with parameter 43003a00 (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter C:/ProgramData (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs/ (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pt-BR (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\fr (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\de (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pl (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ru (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh-Hant (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ja (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ko (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es-MX (UID: 00000000-00005040)","\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\it (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter 43003a00 (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\(UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %ALLUSERSPROFILE%\\GOG.com/Galaxy/logs/ (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pt-BR (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\fr (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\de (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\pl (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ru (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\zh-Hant (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ja (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\ko (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\es-MX (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" with parameter %TEMP%\\GalaxyInstaller_EgtBu\\it (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"$42","description_v2":["Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\GOG-WEBINSTALLERMUTEX\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5040:168:WilStaging_02\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5040:64:WilError_01\"","Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\SM0:5040:64:WilError_01\"","Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\SM0:5040:168:WilStaging_02\"","Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\ZonesCacheCounterMutex\"","Process GOG_Galaxy_2.0.exe created mutex with name \"SM0:5040:64:WilError_01\"","Process GOG_Galaxy_2.0.exe created mutex with name \"GOG-WEBINSTALLERMUTEX\"","Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\BaseNamedObjects\\SyncRootManager\"","Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5040:64:WilError_01\"","Process GalaxyInstaller.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6884:304:WilStaging_02\"","Process GalaxyInstaller.exe created mutex with name \"Local\\SM0:6884:304:WilStaging_02\""],"description_v3":[{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\GOG-WEBINSTALLERMUTEX\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5040:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5040:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\SM0:5040:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\SM0:5040:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"SM0:5040:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"GOG-WEBINSTALLERMUTEX\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\BaseNamedObjects\\SyncRootManager\""},{"type":"linebreak"},{"type":"text","value":"Process GOG_Galaxy_2.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5040:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process GalaxyInstaller.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6884:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process GalaxyInstaller.exe created mutex with name \"Local\\SM0:6884:304:WilStaging_02\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"\"GOG_Galaxy_2.0.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]\n \"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" - [base:0; Status:c0000135]\n \"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:c0000135]\n \"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]\n \"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]\n \"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" - [base:0; Status:c0000135]","description_v2":["\"GOG_Galaxy_2.0.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]","\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" - [base:0; Status:c0000135]","\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:c0000135]","\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]","\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]","\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" - [base:0; Status:c0000135]"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" - [base:0; Status:c0000135]"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","description_v2":["\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a","description_v2":["Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a"],"description_v3":[{"type":"text","value":"Found string - \\.\\pipe\\vvE1XYmXFHECk83F1LNwfDeNgA70QI5MyThJmvpZ15yJpBMZFHGHLoRfh27oM8SHWUW9kG6KRTGi0qB2ESLQ0FDU8WLwrjsS9cPGZ7km9FMtFsuw3B4V6a"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"memorydump-10","type":20,"relevance":1,"name":"Found registry location strings in memory","description":"$43","description_v2":["\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp","\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp","\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000003.293266.029F0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp","\"stry\\Machine\\Software\\Classes\\Applications\\%1.exe\" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp","\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp","\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp","\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp","\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp","\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp","\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"\\Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp","\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp","\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=%ALLUSERSPROFILE%\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000001.283921.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000002.285843.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\NET Framework Setup\\NDP\\v3.5\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\WOW6432NODE\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\WOW6432Node\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\\paths\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\GOG.com\\GalaxyClient\" in Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00005040.00000003.293266.029F0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{A47979D2-C419-11D9-A5B.\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00005040.00000003.293266.02A66000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\Applications\\%1.exe\" in Source: 00000000-00005040.00000003.293266.057C0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000000.282210.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000000.282210.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000000.282210.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000001.284132.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000001.284132.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000002.286051.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000002.286051.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000002.286051.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HINE\\Software\\Microsoft\\StrongName\\Revo\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006884.00000003.293281.02D00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006884.00000003.293281.214E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00006884.00000003.293281.A4000000.00000004.mdmp"}],"origin":"Memory Dumps","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-127","type":2,"relevance":1,"name":"Found user-agent related strings","description":"$44","description_v2":["file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"payload.campaign\")","file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"payload.campaign\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-2","type":7,"relevance":5,"name":"GETs files from a webserver","description":"$45","description_v2":["\"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1","Accept: */*","Accept-Encoding: gzip, deflate","User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","Host: remote-config.gog.com","Connection: Keep-Alive\" Response ==> HTTP/1.1 200 OK","Connection: keep-alive","Content-Length: 279","Server: nginx","Content-Type: application/json","Expires: Mon","03 Nov 2025 23:24:59 GMT","Content-Encoding: gzip","Via: 1.1 varnish","1.1 varnish","cache-control: max-age=120","x-origin-age: 0","x-date: Mon","03 Nov 2025 23:24:59 GMT","Accept-Ranges: bytes","Age: 0","Date: Mon","03 Nov 2025 23:25:00 GMT","X-Served-By: cache-fra-etou8220185-FRA","cache-lax-kwhp1940114-LAX","X-Cache: MISS","MISS","X-Cache-Hits: 0","0","Vary: Accept-Encoding with response body ==>37623A32323A37363A36353A37323A37333A36393A36663A36653A32323A33613A32323A33323A32653A33303A32653A33303A32323A32633A32323A36333A36.......","\"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1","Host: content-system.gog.com","Connection: Keep-Alive\" Response ==> HTTP/1.1 302 Found","Connection: keep-alive","Content-Length: 548","Server: nginx","Content-Type: text/html; charset=UTF-8","Location: https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exe","X-CACHE-ADN-TTL: 3600","Cache-Control: public","max-age=3600","Via: 1.1 varnish","1.1 varnish","x-origin-age: 2278","Accept-Ranges: bytes","Age: 2278","Date: Mon","03 Nov 2025 23:25:04 GMT","X-Served-By: cache-fra-etou8220199-FRA","cache-lax-kwhp1940081-LAX","X-Cache: HIT","MISS","X-Cache-Hits: 1940","0 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33......."],"description_v3":[{"type":"text","value":"\"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"Accept-Encoding: gzip, deflate"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"},{"type":"linebreak"},{"type":"text","value":"Host: remote-config.gog.com"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive\" Response ==> HTTP/1.1 200 OK"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 279"},{"type":"linebreak"},{"type":"text","value":"Server: nginx"},{"type":"linebreak"},{"type":"text","value":"Content-Type: application/json"},{"type":"linebreak"},{"type":"text","value":"Expires: Mon"},{"type":"linebreak"},{"type":"text","value":"03 Nov 2025 23:24:59 GMT"},{"type":"linebreak"},{"type":"text","value":"Content-Encoding: gzip"},{"type":"linebreak"},{"type":"text","value":"Via: 1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"cache-control: max-age=120"},{"type":"linebreak"},{"type":"text","value":"x-origin-age: 0"},{"type":"linebreak"},{"type":"text","value":"x-date: Mon"},{"type":"linebreak"},{"type":"text","value":"03 Nov 2025 23:24:59 GMT"},{"type":"linebreak"},{"type":"text","value":"Accept-Ranges: bytes"},{"type":"linebreak"},{"type":"text","value":"Age: 0"},{"type":"linebreak"},{"type":"text","value":"Date: Mon"},{"type":"linebreak"},{"type":"text","value":"03 Nov 2025 23:25:00 GMT"},{"type":"linebreak"},{"type":"text","value":"X-Served-By: cache-fra-etou8220185-FRA"},{"type":"linebreak"},{"type":"text","value":"cache-lax-kwhp1940114-LAX"},{"type":"linebreak"},{"type":"text","value":"X-Cache: MISS"},{"type":"linebreak"},{"type":"text","value":"MISS"},{"type":"linebreak"},{"type":"text","value":"X-Cache-Hits: 0"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"Vary: Accept-Encoding with response body ==>37623A32323A37363A36353A37323A37333A36393A36663A36653A32323A33613A32323A33323A32653A33303A32653A33303A32323A32633A32323A36333A36......."},{"type":"linebreak"},{"type":"text","value":"\"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: content-system.gog.com"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive\" Response ==> HTTP/1.1 302 Found"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 548"},{"type":"linebreak"},{"type":"text","value":"Server: nginx"},{"type":"linebreak"},{"type":"text","value":"Content-Type: text/html; charset=UTF-8"},{"type":"linebreak"},{"type":"text","value":"Location: https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exe"},{"type":"linebreak"},{"type":"text","value":"X-CACHE-ADN-TTL: 3600"},{"type":"linebreak"},{"type":"text","value":"Cache-Control: public"},{"type":"linebreak"},{"type":"text","value":"max-age=3600"},{"type":"linebreak"},{"type":"text","value":"Via: 1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"x-origin-age: 2278"},{"type":"linebreak"},{"type":"text","value":"Accept-Ranges: bytes"},{"type":"linebreak"},{"type":"text","value":"Age: 2278"},{"type":"linebreak"},{"type":"text","value":"Date: Mon"},{"type":"linebreak"},{"type":"text","value":"03 Nov 2025 23:25:04 GMT"},{"type":"linebreak"},{"type":"text","value":"X-Served-By: cache-fra-etou8220199-FRA"},{"type":"linebreak"},{"type":"text","value":"cache-lax-kwhp1940081-LAX"},{"type":"linebreak"},{"type":"text","value":"X-Cache: HIT"},{"type":"linebreak"},{"type":"text","value":"MISS"},{"type":"linebreak"},{"type":"text","value":"X-Cache-Hits: 1940"},{"type":"linebreak"},{"type":"text","value":"0 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33......."}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$46","description_v2":["\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 756b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 756b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 756b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"KERNEL32\" at base 75130000","\"GOG_Galaxy_2.0.exe\" loaded module \"KERNEL32.DLL\" at base 75130000","\"GOG_Galaxy_2.0.exe\" loaded module \"ADVAPI32.DLL\" at base 75890000","\"GOG_Galaxy_2.0.exe\" loaded module \"SHELL32.DLL\" at base 765e0000","\"GOG_Galaxy_2.0.exe\" loaded module \"SHLWAPI.DLL\" at base 752e0000","\"GOG_Galaxy_2.0.exe\" loaded module \"URLMON.DLL\" at base 73cc0000","\"GOG_Galaxy_2.0.exe\" loaded module \"USER32.DLL\" at base 74740000","\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-SYSINFO-L1-2-1\" at base 756b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"MSISO.DLL\" at base 733b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73e80000","\"GOG_Galaxy_2.0.exe\" loaded module \"PHONEINFO.DLL\" at base 0","\"GOG_Galaxy_2.0.exe\" loaded module \"RPCRT4.DLL\" at base 74fd0000","\"GOG_Galaxy_2.0.exe\" loaded module \"SSPICLI.DLL\" at base 743d0000","\"GOG_Galaxy_2.0.exe\" loaded module \"ONDEMANDCONNROUTEHELPER.DLL\" at base 730c0000","\"GOG_Galaxy_2.0.exe\" loaded module \"WINHTTP.DLL\" at base 73010000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ONDEMANDCONNROUTEHELPER.DLL\" at base 730c0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 73680000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 72ff0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 72fa0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WS2_32\" at base 74a70000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SCHANNEL.DLL\" at base 72f30000","\"GOG_Galaxy_2.0.exe\" loaded module \"MSKEYPROTECT.DLL\" at base 72f20000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WINTRUST.DLL\" at base 74460000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72e90000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 74f70000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 72e40000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\CRYPTNET.DLL\" at base 72e40000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 748c0000","\"GOG_Galaxy_2.0.exe\" loaded module \"CRYPTNET.DLL\" at base 72e40000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 72e20000","\"GOG_Galaxy_2.0.exe\" loaded module \"WS2_32.DLL\" at base 74a70000","\"GOG_Galaxy_2.0.exe\" loaded module \"NTDLL.DLL\" at base 779b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73920000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 75ec0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\\\WINDOWS.STATEREPOSITORYPS.DLL\" at base 72cf0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHELL32.DLL\" at base 765e0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\URLMON.DLL\" at base 73cc0000","\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 756b0000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 74320000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SFC_OS.DLL\" at base 72cb0000","\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffa28f30000","\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffa28f30000","\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffa28f30000","\"GalaxyInstaller.exe\" loaded module \"KERNEL32\" at base 7ffa2c590000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\IPHLPAPI.DLL\" at base 0","\"GalaxyInstaller.exe\" loaded module \"IPHLPAPI.DLL\" at base 7ffa27fe0000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 7ffa28250000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 7ffa20690000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 7ffa20850000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\SECUR32.DLL\" at base 0","\"GalaxyInstaller.exe\" loaded module \"SECUR32.DLL\" at base 7ffa1f510000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ffa27da0000","\"GalaxyInstaller.exe\" loaded module \"SSPICLI.DLL\" at base 7ffa28920000","\"GalaxyInstaller.exe\" loaded module \"MSKEYPROTECT.DLL\" at base 7ffa1a7a0000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 7ffa1a330000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0","\"GalaxyInstaller.exe\" loaded module \"CRYPT32.DLL\" at base 7ffa29950000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CRYPT32.DLL\" at base 0","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffa27e60000","\"GalaxyInstaller.exe\" loaded module \"WS2_32.DLL\" at base 7ffa2a000000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.WINDOWS.FORMS\\V4.0_4.0.0.0__B77A5C561934E089\\COMCTL32.DLL\" at base 0","\"GalaxyInstaller.exe\" loaded module \"COMCTL32.DLL\" at base 7ffa17250000","\"GalaxyInstaller.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffa29f30000","\"GalaxyInstaller.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL\" at base 7ffa2aa20000","\"GalaxyInstaller.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL\" at base 7ffa2aa20000","\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-COM-L1-1-0.DLL\" at base 7ffa2a4c0000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 7ffa2ad90000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 7ffa2abb0000"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 756b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 756b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 756b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"KERNEL32\" at base 75130000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"KERNEL32.DLL\" at base 75130000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"ADVAPI32.DLL\" at base 75890000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"SHELL32.DLL\" at base 765e0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"SHLWAPI.DLL\" at base 752e0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"URLMON.DLL\" at base 73cc0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"USER32.DLL\" at base 74740000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-SYSINFO-L1-2-1\" at base 756b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"MSISO.DLL\" at base 733b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73e80000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"PHONEINFO.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"RPCRT4.DLL\" at base 74fd0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"SSPICLI.DLL\" at base 743d0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"ONDEMANDCONNROUTEHELPER.DLL\" at base 730c0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"WINHTTP.DLL\" at base 73010000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ONDEMANDCONNROUTEHELPER.DLL\" at base 730c0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 73680000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 72ff0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 72fa0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WS2_32\" at base 74a70000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SCHANNEL.DLL\" at base 72f30000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"MSKEYPROTECT.DLL\" at base 72f20000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WINTRUST.DLL\" at base 74460000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72e90000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 74f70000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 72e40000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\CRYPTNET.DLL\" at base 72e40000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 748c0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"CRYPTNET.DLL\" at base 72e40000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 72e20000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"WS2_32.DLL\" at base 74a70000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"NTDLL.DLL\" at base 779b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73920000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 75ec0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\\\WINDOWS.STATEREPOSITORYPS.DLL\" at base 72cf0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHELL32.DLL\" at base 765e0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSWOW64\\URLMON.DLL\" at base 73cc0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 756b0000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 74320000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SFC_OS.DLL\" at base 72cb0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffa28f30000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffa28f30000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffa28f30000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"KERNEL32\" at base 7ffa2c590000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\IPHLPAPI.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"IPHLPAPI.DLL\" at base 7ffa27fe0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 7ffa28250000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 7ffa20690000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 7ffa20850000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\SECUR32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"SECUR32.DLL\" at base 7ffa1f510000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ffa27da0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"SSPICLI.DLL\" at base 7ffa28920000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"MSKEYPROTECT.DLL\" at base 7ffa1a7a0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 7ffa1a330000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"CRYPT32.DLL\" at base 7ffa29950000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffa27e60000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"WS2_32.DLL\" at base 7ffa2a000000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.WINDOWS.FORMS\\V4.0_4.0.0.0__B77A5C561934E089\\COMCTL32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"COMCTL32.DLL\" at base 7ffa17250000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffa29f30000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL\" at base 7ffa2aa20000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL\" at base 7ffa2aa20000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"API-MS-WIN-CORE-COM-L1-1-0.DLL\" at base 7ffa2a4c0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 7ffa2ad90000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 7ffa2abb0000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FB1E0000","description_v2":["\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FB1E0000"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FB1E0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F70000\n \"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73750000\n \"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 29B20000\n \"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 28580000","description_v2":["\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F70000","\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73750000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 29B20000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 28580000"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F70000"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73750000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 29B20000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 28580000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-7","type":10,"relevance":0,"name":"Loads the CLR Loader DLL","description":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 033C0000","description_v2":["\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 033C0000"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 033C0000"}],"origin":"Loaded Module","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FD0000\n \"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 29CB0000","description_v2":["\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FD0000","\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 29CB0000"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FD0000"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 29CB0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"GOG_Galaxy_2.0.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"GOG_Galaxy_2.0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"GOG_Galaxy_2.0.exe\" was detected as \"UPX\" and name: \"Packer\"","\"GOG_Galaxy_2.0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" was detected as \"UPX\" and name: \"Packer\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$47","description_v2":["\"GOG_Galaxy_2.0.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"GOG_Galaxy_2.0.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","\"GOG_Galaxy_2.0.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")","\"GOG_Galaxy_2.0.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\INSTANCE\")","\"GOG_Galaxy_2.0.exe\" touched \"Shell File System Folder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")","\"GOG_Galaxy_2.0.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")","\"GOG_Galaxy_2.0.exe\" touched \"Known Folder Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\\TREATAS\")","\"GOG_Galaxy_2.0.exe\" touched \"Sync root manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\\INSTANCE\")","\"GOG_Galaxy_2.0.exe\" touched \"Security Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","\"GOG_Galaxy_2.0.exe\" touched \"ShellItemArray Shell Namespace helper\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\\TREATAS\")","\"GOG_Galaxy_2.0.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\INSTANCE\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Shell File System Folder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Known Folder Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Sync root manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\\INSTANCE\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"Security Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"ShellItemArray Shell Namespace helper\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX0\"\n \"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX1\"","description_v2":["\"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX0\"","\"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX1\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX0\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an executable section named \"UPX1\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX0\"\n \"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX1\"\n \"GOG_Galaxy_2.0.exe\" has an writable section named \".rsrc\"","description_v2":["\"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX0\"","\"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX1\"","\"GOG_Galaxy_2.0.exe\" has an writable section named \".rsrc\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX0\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an writable section named \"UPX1\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an writable section named \".rsrc\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"GOG_Galaxy_2.0.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x554000,lea\tedi, [esi - 0x153000],push\tedi,jmp\t0x5c62fa,nop\t,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,add\tebx, ebx,jne\t0x5c6301,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c62f0,mov\teax, 1,add\tebx, ebx,jne\t0x5c6313,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,add\tebx, ebx,jae\t0x5c6324,jne\t0x5c6343,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c6343,dec\teax,add\tebx, ebx,jne\t0x5c6330,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,jmp\t0x5c6308,add\tebx, ebx,jne\t0x5c633f,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\tecx, ecx,jmp\t0x5c6395,\"","description_v2":["\"GOG_Galaxy_2.0.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x554000,lea\tedi, [esi - 0x153000],push\tedi,jmp\t0x5c62fa,nop\t,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,add\tebx, ebx,jne\t0x5c6301,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c62f0,mov\teax, 1,add\tebx, ebx,jne\t0x5c6313,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,add\tebx, ebx,jae\t0x5c6324,jne\t0x5c6343,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c6343,dec\teax,add\tebx, ebx,jne\t0x5c6330,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,jmp\t0x5c6308,add\tebx, ebx,jne\t0x5c633f,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\tecx, ecx,jmp\t0x5c6395,\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x554000,lea\tedi, [esi - 0x153000],push\tedi,jmp\t0x5c62fa,nop\t,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,add\tebx, ebx,jne\t0x5c6301,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c62f0,mov\teax, 1,add\tebx, ebx,jne\t0x5c6313,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,add\tebx, ebx,jae\t0x5c6324,jne\t0x5c6343,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x5c6343,dec\teax,add\tebx, ebx,jne\t0x5c6330,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,jmp\t0x5c6308,add\tebx, ebx,jne\t0x5c633f,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\tecx, ecx,jmp\t0x5c6395,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x153000\" greater than 0x100000","description_v2":["Virtual size of \"UPX0\" is \"0x153000\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \"UPX0\" is \"0x153000\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"GalaxyInstaller.exe\" (UID: 00000000-00006884) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"GalaxyInstaller.exe\" (UID: 00000000-00006884) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","description_v2":["Process \"GalaxyInstaller.exe\" (UID: 00000000-00006884) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"GalaxyInstaller.exe\" (UID: 00000000-00006884) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\""],"description_v3":[{"type":"text","value":"Process \"GalaxyInstaller.exe\""},{"type":"process","process_uid":"00000000-00006884","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"GalaxyInstaller.exe\""},{"type":"process","process_uid":"00000000-00006884","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-51","type":7,"relevance":1,"name":"Queries DNS server","description":"\"content-system.gog.com\"\n \"insights-collector.gog.com\"\n \"remote-config.gog.com\"","description_v2":["\"content-system.gog.com\"","\"insights-collector.gog.com\"","\"remote-config.gog.com\""],"description_v3":[{"type":"text","value":"\"content-system.gog.com\""},{"type":"linebreak"},{"type":"text","value":"\"insights-collector.gog.com\""},{"type":"linebreak"},{"type":"text","value":"\"remote-config.gog.com\""}],"origin":"Network Traffic","attck_id":"T1071.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"$48","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"KO-KR\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"KO-KR\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-CN\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-CN\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-HK\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-HK\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"JA-JP\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"JA-JP\")","\"GalaxyInstaller.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"KO-KR\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"KO-KR\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-CN\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-CN\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ZH-HK\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"ZH-HK\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"JA-JP\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"JA-JP\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" [Source: 00000000-00006884-00000C2A-3408478610]\n Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" [Source: 00000000-00006884-00000C2A-3408763550]\n Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00006884-00000C2A-3409113523]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00006884-00000C2A-3409395760]\n Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" [Source: 00000000-00006884-00000C2A-3410180339]","description_v2":["Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" [Source: 00000000-00006884-00000C2A-3408478610]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" [Source: 00000000-00006884-00000C2A-3408763550]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00006884-00000C2A-3409113523]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00006884-00000C2A-3409395760]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" [Source: 00000000-00006884-00000C2A-3410180339]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\iphlpapi.dll\" [Source: 00000000-00006884-00000C2A-3408478610]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" [Source: 00000000-00006884-00000C2A-3408763550]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00006884-00000C2A-3409113523]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00006884-00000C2A-3409395760]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\comctl32.dll\" [Source: 00000000-00006884-00000C2A-3410180339]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"GalaxyInstaller.exe\" (UID: 00000000-00006884)","description_v2":["Spawned process \"GalaxyInstaller.exe\" (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"Spawned process \"GalaxyInstaller.exe\""},{"type":"process","process_uid":"00000000-00006884","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"Spawned process \"GalaxyInstaller.exe\" (UID: 00000000-00006884)","description_v2":["Spawned process \"GalaxyInstaller.exe\" (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"Spawned process \"GalaxyInstaller.exe\""},{"type":"process","process_uid":"00000000-00006884","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"$49","description_v2":["The input sample is signed with a certificate issued by \"CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US\" (SHA1: AD:B1:59:DE:98:F5:DA:AC:D0:94:AB:BD:B4:10:15:5E:49:0C:31:88; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert","Inc.\", C=US\" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert","Inc.\", C=US\" (SHA1: DF:1C:BC:F2:B1:AF:03:6C:55:D1:22:A8:8A:27:19:D3:22:79:16:A8; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US\" (SHA1: AD:B1:59:DE:98:F5:DA:AC:D0:94:AB:BD:B4:10:15:5E:49:0C:31:88; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: DF:1C:BC:F2:B1:AF:03:6C:55:D1:22:A8:8A:27:19:D3:22:79:16:A8; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-2","type":17,"relevance":10,"name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","description_v2":["The entire certificate chain of the input sample was validated successfully."],"description_v3":[{"type":"text","value":"The entire certificate chain of the input sample was validated successfully."}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-267","type":6,"relevance":1,"name":"Writes files in a temp directory","description":"\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\remoteconfig.json\"\n \"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.base64\"\n \"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.campaign\"\n \"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\icon.ico\"","description_v2":["\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\remoteconfig.json\"","\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.base64\"","\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.campaign\"","\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\icon.ico\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes to a file \"%TEMP%\\GalaxyInstaller_EgtBu\\remoteconfig.json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.base64\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\payload.campaign\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\icon.ico\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-938","type":2,"relevance":1,"name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"System.IsAttachment\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")\n Found string \"ystem.IsAttachment\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","description_v2":["Found string \"System.IsAttachment\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.Message.HasAttachments\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"ystem.IsAttachment\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")","Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"System.IsAttachment\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.HasAttachments\" (Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00005040.00000003.293266.04B40000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1505.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"GOG_Galaxy_2.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GalaxyInstaller.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"GOG_Galaxy_2.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"GalaxyInstaller.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"icon.ico\" has type \"MS Windows icon resource - 17 icons 112x112 32 bits/pixel -128x-128 32 bits/pixel\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\icon.ico]- [targetUID: 00000000-00005040]\n \"InstallerWebinstaller.log\" has type \"ASCII text with very long lines (839) with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\GOG.com\\Galaxy\\logs\\InstallerWebinstaller.log]- [targetUID: 00000000-00006884]\n \"payload.base64\" has type \"ASCII text with very long lines (792) with no line terminators\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.base64]- [targetUID: 00000000-00005040]\n \"payload.campaign\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.campaign]- [targetUID: 00000000-00005040]\n \"remoteconfig.json\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\remoteconfig.json]- [targetUID: 00000000-00005040]\n \"webinstaller_1_.json\" has type \"Unknown\"- [targetUID: N/A]","description_v2":["\"icon.ico\" has type \"MS Windows icon resource - 17 icons 112x112 32 bits/pixel -128x-128 32 bits/pixel\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\icon.ico]- [targetUID: 00000000-00005040]","\"InstallerWebinstaller.log\" has type \"ASCII text with very long lines (839) with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\GOG.com\\Galaxy\\logs\\InstallerWebinstaller.log]- [targetUID: 00000000-00006884]","\"payload.base64\" has type \"ASCII text with very long lines (792) with no line terminators\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.base64]- [targetUID: 00000000-00005040]","\"payload.campaign\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.campaign]- [targetUID: 00000000-00005040]","\"remoteconfig.json\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\remoteconfig.json]- [targetUID: 00000000-00005040]","\"webinstaller_1_.json\" has type \"Unknown\"- [targetUID: N/A]"],"description_v3":[{"type":"text","value":"\"icon.ico\" has type \"MS Windows icon resource - 17 icons 112x112 32 bits/pixel -128x-128 32 bits/pixel\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\icon.ico]- [targetUID: 00000000-00005040]"},{"type":"linebreak"},{"type":"text","value":"\"InstallerWebinstaller.log\" has type \"ASCII text with very long lines (839) with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\GOG.com\\Galaxy\\logs\\InstallerWebinstaller.log]- [targetUID: 00000000-00006884]"},{"type":"linebreak"},{"type":"text","value":"\"payload.base64\" has type \"ASCII text with very long lines (792) with no line terminators\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.base64]- [targetUID: 00000000-00005040]"},{"type":"linebreak"},{"type":"text","value":"\"payload.campaign\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\payload.campaign]- [targetUID: 00000000-00005040]"},{"type":"linebreak"},{"type":"text","value":"\"remoteconfig.json\" has type \"JSON text data\"- Location: [%TEMP%\\GalaxyInstaller_EgtBu\\remoteconfig.json]- [targetUID: 00000000-00005040]"},{"type":"linebreak"},{"type":"text","value":"\"webinstaller_1_.json\" has type \"Unknown\"- [targetUID: N/A]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$4a","description_v2":["\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"GOG_Galaxy_2.0.exe\" queries basic process information of the \"C:\\GOG_Galaxy_2.0.exe\" (UID: 5040)","description_v2":["\"GOG_Galaxy_2.0.exe\" queries basic process information of the \"C:\\GOG_Galaxy_2.0.exe\" (UID: 5040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" queries basic process information of the \"C:\\GOG_Galaxy_2.0.exe\" (UID: 5040)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$4b","description_v2":["\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"GOG_GALAXY_2.0.EXE\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"GOG_GALAXY_2.0\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"GOG_GALAXY_2.0.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"GOG_GALAXY_2.0\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-85","type":6,"relevance":3,"name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"GOG_Galaxy_2.0.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005040)\n \"GalaxyInstaller.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006884)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005040)","\"GalaxyInstaller.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006884)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005040)"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006884)"}],"origin":"API Call","attck_id":"T1055.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"$4c","description_v2":["\"GOG_Galaxy_2.0.exe\" reads file \"c:\\gog_galaxy_2.0.exe\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\webinstaller[1].json\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\remoteconfig.json\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\searches\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\contacts\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\favorites\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\links\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\%osuser%\\saved games\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\desktop.ini\"","\"GalaxyInstaller.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\galaxyinstaller.exe.config\"","\"GalaxyInstaller.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"c:\\gog_galaxy_2.0.exe\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\webinstaller[1].json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"%TEMP%\\galaxyinstaller_egtbu\\remoteconfig.json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\documents\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\music\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\pictures\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\videos\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\downloads\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\onedrive\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\searches\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\contacts\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\favorites\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\links\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\saved games\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"c:\\users\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" reads file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\galaxyinstaller.exe.config\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains ability to delay the execution of current thread","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: Contains ability to detect virtual environment (API)","Matched sigs: Makes a code branch decision directly after an API that is environment aware"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay the execution of current thread"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect virtual environment (API)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Makes a code branch decision directly after an API that is environment aware"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\URLMON.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\urlmon.dll\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\IERTUTIL.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\iertutil.dll\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"","description_v2":["\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\URLMON.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\urlmon.dll\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\IERTUTIL.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\iertutil.dll\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\URLMON.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\urlmon.dll\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\IERTUTIL.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\iertutil.dll\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\"\n \"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\"\n \"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","description_v2":["\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"","\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"","\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"","\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\"","\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"","\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\"","\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\History\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\webinstaller[1].json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\URLMON.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\PHONEINFO.DLL\"\n \"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\phoneinfo.dll\"","description_v2":["\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\URLMON.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\PHONEINFO.DLL\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\phoneinfo.dll\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\URLMON.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\PHONEINFO.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\phoneinfo.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$4d","description_v2":["\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GALAXYINSTALLER_EGTBU\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\REMOTECONFIG.JSON\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\remoteconfig.json\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\GOGGALAXY.AUTH\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\gogGalaxy.auth\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe:ZONE.IDENTIFIER\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe:Zone.Identifier\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\WinSxS\\FileMaps\\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_GALAXYINSTALLER_EGTBU_B829B2429A02A704.CDF-MS\"","\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"\\SystemRoot\\WinSxS\\FileMaps\\users_%OSUSER%_appdata_local_temp_galaxyinstaller_egtbu_b829b2429a02a704.cdf-ms\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\FUSION.LOCALGAC\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\GALAXYINSTALLER.EXE.LOG\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\GALAXYWEBINSTALLER\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GALAXYINSTALLER.INI\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\"","\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GALAXYINSTALLER.EXE.LOCAL\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"%TEMP%\\GALAXYINSTALLER_EGTBU\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\REMOTECONFIG.JSON\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\remoteconfig.json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"\\Device\\RasAcd\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\GOGGALAXY.AUTH\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\gogGalaxy.auth\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe:ZONE.IDENTIFIER\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe:Zone.Identifier\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"C:\\Windows\\WinSxS\\FileMaps\\USERS_%OSUSER%_APPDATA_LOCAL_TEMP_GALAXYINSTALLER_EGTBU_B829B2429A02A704.CDF-MS\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" trying to access non-existent file \"\\SystemRoot\\WinSxS\\FileMaps\\users_%OSUSER%_appdata_local_temp_galaxyinstaller_egtbu_b829b2429a02a704.cdf-ms\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\FUSION.LOCALGAC\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\GALAXYINSTALLER.EXE.LOG\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\GALAXYWEBINSTALLER\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GALAXYINSTALLER.INI\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Windows\\assembly\\GAC\\PUBLISHERPOLICY.TME\""},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GALAXYINSTALLER.EXE.LOCAL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"GOG_Galaxy_2.0.exe\" writes file \"c:\\programdata\\gog.com\\galaxy\\logs\\installerbootstrapper.log\"\n \"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\webinstaller[1].json\"\n \"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\remoteconfig.json\"\n \"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.base64\"\n \"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.campaign\"","description_v2":["\"GOG_Galaxy_2.0.exe\" writes file \"c:\\programdata\\gog.com\\galaxy\\logs\\installerbootstrapper.log\"","\"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\webinstaller[1].json\"","\"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\remoteconfig.json\"","\"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.base64\"","\"GOG_Galaxy_2.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.campaign\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes file \"%ALLUSERSPROFILE%\\gog.com\\galaxy\\logs\\installerbootstrapper.log\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\lscby323\\webinstaller[1].json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\remoteconfig.json\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.base64\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\galaxyinstaller_egtbu\\payload.campaign\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-159","type":6,"relevance":1,"name":"Writes log files","description":"\"GOG_Galaxy_2.0.exe\" writes a file \"C:\\ProgramData\\GOG.com\\Galaxy\\logs\\InstallerBootstrapper.log\"","description_v2":["\"GOG_Galaxy_2.0.exe\" writes a file \"C:\\ProgramData\\GOG.com\\Galaxy\\logs\\InstallerBootstrapper.log\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" writes a file \"%ALLUSERSPROFILE%\\GOG.com\\Galaxy\\logs\\InstallerBootstrapper.log\""}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-879","type":2,"relevance":1,"name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006884-00000C2B-3409914485\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006884-00000C2B-3409914485\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006884-00000C2B-3409914485\")"}],"origin":"File/Memory","attck_id":"T1205.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"api-118","type":6,"relevance":3,"name":"Calls an API typically used to retrieve the URL data","description":"\"GOG_Galaxy_2.0.exe\" called \"InternetReadFile\" with parameter 533 (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"InternetReadFile\" with parameter 533 (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"InternetReadFile\" with parameter 533 (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-62","type":7,"relevance":1,"name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /components/webinstaller?component_version=2.0.0\"\n Found http requests in header \"POST /clients/52138777094359967/events\"\n Found http requests in header \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe\"","description_v2":["Found http requests in header \"GET /components/webinstaller?component_version=2.0.0\"","Found http requests in header \"POST /clients/52138777094359967/events\"","Found http requests in header \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe\""],"description_v3":[{"type":"text","value":"Found http requests in header \"GET /components/webinstaller?component_version=2.0.0\""},{"type":"linebreak"},{"type":"text","value":"Found http requests in header \"POST /clients/52138777094359967/events\""},{"type":"linebreak"},{"type":"text","value":"Found http requests in header \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe\""}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-505","type":2,"relevance":1,"name":"Communicates with HTTPS webserver (GET/POST requests)","description":"Found requests in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\"; in File: \"SSL\")","description_v2":["Found requests in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\"; in File: \"SSL\")"],"description_v3":[{"type":"text","value":"Found requests in header \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\"; in File: \"SSL\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005040-00000C2B-3405875713\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006884-00000C2B-3410299774\")","description_v2":["Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005040-00000C2B-3405875713\")","Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006884-00000C2B-3410299774\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005040-00000C2B-3405875713\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006884-00000C2B-3410299774\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-241","type":2,"relevance":1,"name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-323","type":2,"relevance":1,"name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","description_v2":["Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-899","type":2,"relevance":1,"name":"Contains references to network communication API (string)","description":"$4e","description_v2":["Found reference to API \"ile System Bind Data\" (Indicator: \" bind \"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found reference to API \"DUnable to connect to GOG.com. Please check your internet connection.\" (Indicator: \" connect \"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"DUnable to connect to GOG.com. Please check your internet connection.\" (Indicator: \" connect \"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")","Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ile System Bind Data\" (Indicator: \" bind \"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DUnable to connect to GOG.com. Please check your internet connection.\" (Indicator: \" connect \"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DUnable to connect to GOG.com. Please check your internet connection.\" (Indicator: \" connect \"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-102","type":2,"relevance":3,"name":"Decrypted SSL network traffic","description":"$4f","description_v2":["\"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\"","\"{\"type\": \"galaxy_download_started\", \"date\": \"2025-11-03T23:25:01-08:00\", \"uuid\": \"5359e8a7-6f95-4442-a329-5c36d0623cc6\", \"meta\": {\"campaign\": {\"campaign\":{\"origin\":\"http://galaxy2-signup.gog.prod/en/?embeddable=true\",\"origin_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0\",\"unique_id\":\"1762212211-VIzNemO4a3XG0M8lTdK4PA==\"},\"login_parameters\":\"origin=http%3A%2F%2Fgalaxy2-signup.gog.prod%2Fen%2F%3Fembeddable%3Dtrue&origin_user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F142.0.0.0+Safari%2F537.36+Edg%2F142.0.0.0&unique_id=1762212211-VIzNemO4a3XG0M8lTdK4PA%3D%3D\"}}, \"data\": {\"current_version\": \"\", \"version\": \"2.0.90.23\"}}\"","\"HTTP/1.1 100 Continue\"","\"HTTP/1.1 204 No ContentConnection: keep-aliveServer: nginxCache-Control: max-age=0, no-cache, no-store, privatex-origin-age: 0Accept-Ranges: bytesVia: 1.1 varnish, 1.1 varnishDate: Mon, 03 Nov 2025 23:25:04 GMTX-Served-By: cache-fra-etou8220152-FRA, cache-lax-kwhp1940033-LAXX-Cache: MISS, MISSX-Cache-Hits: 0, 0\""],"description_v3":[{"type":"text","value":"\"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"\"{\"type\": \"galaxy_download_started\", \"date\": \"2025-11-03T23:25:01-08:00\", \"uuid\": \"5359e8a7-6f95-4442-a329-5c36d0623cc6\", \"meta\": {\"campaign\": {\"campaign\":{\"origin\":\"http://galaxy2-signup.gog.prod/en/?embeddable=true\",\"origin_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0\",\"unique_id\":\"1762212211-VIzNemO4a3XG0M8lTdK4PA==\"},\"login_parameters\":\"origin=http%3A%2F%2Fgalaxy2-signup.gog.prod%2Fen%2F%3Fembeddable%3Dtrue&origin_user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F142.0.0.0+Safari%2F537.36+Edg%2F142.0.0.0&unique_id=1762212211-VIzNemO4a3XG0M8lTdK4PA%3D%3D\"}}, \"data\": {\"current_version\": \"\", \"version\": \"2.0.90.23\"}}\""},{"type":"linebreak"},{"type":"text","value":"\"HTTP/1.1 100 Continue\""},{"type":"linebreak"},{"type":"text","value":"\"HTTP/1.1 204 No ContentConnection: keep-aliveServer: nginxCache-Control: max-age=0, no-cache, no-store, privatex-origin-age: 0Accept-Ranges: bytesVia: 1.1 varnish, 1.1 varnishDate: Mon, 03 Nov 2025 23:25:04 GMTX-Served-By: cache-fra-etou8220152-FRA, cache-lax-kwhp1940033-LAXX-Cache: MISS, MISSX-Cache-Hits: 0, 0\""}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-169","type":2,"relevance":1,"name":"Found mail related domain names","description":"Observed email domain:\"galaxywebinstaller.localization.strings.es-mx.resources\" [Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp]","description_v2":["Observed email domain:\"galaxywebinstaller.localization.strings.es-mx.resources\" [Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp]"],"description_v3":[{"type":"text","value":"Observed email domain:\"galaxywebinstaller.localization.strings.es-mx.resources\" [Source: 00000000-00005040.00000003.293266.00401000.00000040.mdmp]"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"\"2.0.0.2\"\n \"4.0.0.0\"\n \"14.0.0.0\"\n \"192.168.0.2\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.29.15\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Cult\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" requirePermission=\"false\" allowDefinition=\"MachineToApplication\" />\", \"192.168.0.1\", \"255.255.255.255\", \"49.1.1.2\"","description_v2":["\"2.0.0.2\"","\"4.0.0.0\"","\"14.0.0.0\"","\"192.168.0.2\"","\"2.5.29.17\"","\"2.5.29.31\"","\"2.5.29.32\"","\"2.5.4.3\"","\"2.5.29.14\"","Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"","Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"","\"2.5.29.19\"","\"2.5.29.1\"","\"2.5.29.15\"","\"2.5.29.10\"","\"2.5.29.16\"","Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Cult\"","Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" requirePermission=\"false\" allowDefinition=\"MachineToApplication\" />\", \"192.168.0.1\", \"255.255.255.255\", \"49.1.1.2\""],"description_v3":[{"type":"text","value":"\"2.0.0.2\""},{"type":"linebreak"},{"type":"text","value":"\"4.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"14.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.17\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.31\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.32\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.3\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.1\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.16\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Cult\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" requirePermission=\"false\" allowDefinition=\"MachineToApplication\" />\", \"192.168.0.1\", \"255.255.255.255\", \"49.1.1.2\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$50","description_v2":["Heuristic match: \"\\(t,.cr\"","Heuristic match: \"(\\\\].in\"","Heuristic match: \"g6.az\"","Pattern match: \"www.digicert.com1$0\"","Pattern match: \"www.digicert.com1!0\"","Pattern match: \"http://ocsp.digicert.com0c\"","Pattern match: \"cacerts.digicert.com/digicertassuredidrootca.crt0e\"","Pattern match: \"crl3.digicert.com/digicertassuredidrootca.crl0\"","Pattern match: \"http://ocsp.digicert.com0a\"","Pattern match: \"cacerts.digicert.com/digicerttrustedrootg4.crt0c\"","Pattern match: \"crl3.digicert.com/digicerttrustedrootg4.crl0\"","Pattern match: \"http://ocsp.digicert.com0\"","Pattern match: \"cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_\"","Pattern match: \"crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0\"","Pattern match: \"http://www.digicert.com/cps0\"","Pattern match: \"crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s\"","Pattern match: \"crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0\"","Pattern match: \"http://ocsp.digicert.com0\\\"","Pattern match: \"cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0\"","Pattern match: \"http://galaxy2-signup.gog.prod/en/?embeddable=true,origin_user_agent:mozilla/5.0\"","Heuristic match: \"remote-config.gog.com\"","Heuristic match: \"insights-collector.gog.com\"","Heuristic match: \"content-system.gog.com\"","Pattern match: \"support.gog.com/hc/de\"","Heuristic match: \"something went wrong while installing gog galaxy. please try again or contact support.gog.com\"","Heuristic match: \"algo deu errado ao instalar o gog galaxy. por favor, tente novamente ou entre em contato com support.gog.com\"","Pattern match: \"https://remote-config.gog.com/components/webinstaller?component_version=2.0.0\"","Pattern match: \"gog.com/galaxy/logs/\"","Heuristic match: \"upport.gog.com\"","Heuristic match: \"support.gog.com\"","Heuristic match: \"g.com\"","Heuristic match: \"ovamente ou entre em contato com support.gog.com\"","Heuristic match: \"er le support.gog.com\"","Heuristic match: \"t wrong while installing gog galaxy. please try again or contact support.gog.com\"","Pattern match: \"remote-config.gog.com/components/webinstaller/clients/\"","Pattern match: \"galaxy-client-reports.gog.com/problem.php\"","Heuristic match: \"hts-collector.gog.com\"","Heuristic match: \">>$this.name\"","Heuristic match: \">>backgroundworkerdownload.name\"","Heuristic match: \">>backgroundworkerrunsetup.name\"","Heuristic match: \">>buttonerrorexit.name\"","Heuristic match: \"belerror.name\"","Heuristic match: \"rogresssize.name\"","Heuristic match: \"essstats.name\"","Heuristic match: \"aybackground.name\"","Heuristic match: \"oad.name\"","Heuristic match: \"d.name\"","Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"","Heuristic match: \"%allusersprofile%\\gog.com\"","Pattern match: \"gog.com/galaxy\"","Pattern match: \"gog.com/galaxy/logs\"","Pattern match: \"https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exex-cache-adn-ttl\"","Pattern match: \"og.com/galaxy/\"","Pattern match: \"gog.com/galaxy/logs/installerbootstrapper.log\"","Pattern match: \"remote-config.gog.com/components/webinstaller?component_version=2.0.0\"","Heuristic match: \"emote-config.gog.com\"","Heuristic match: \"gog.com\"","Heuristic match: \"og.com\"","Heuristic match: \"ttps://login.live.com\"","Heuristic match: \".sni.global.fastly.net\"","Heuristic match: \"ntrust.net\"","Heuristic match: \"*.gog.com\"","Pattern match: \"http://crl.comodoca.com/comodorsacertificationauthority.crl0q\"","Pattern match: \"http://crt.comodoca.com/comodorsaaddtrustca.crt0$\"","Pattern match: \"http://ocsp.comodoca.com0\"","Pattern match: \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v\"","Pattern match: \"crt.usertrust.com/usertrustrsaaddtrustca.crt0%\"","Pattern match: \"http://ocsp.usertrust.com0\"","Pattern match: \"http://certs.godaddy.com/repository/1301\"","Pattern match: \"http://ocsp.godaddy.com/05\"","Pattern match: \"http://crl.godaddy.com/gdroot-g2.crl0f\"","Pattern match: \"https://certs.godaddy.com/repository/0\"","Pattern match: \"http://ocsp.thawte.com0\"","Pattern match: \"https://www.thawte.com/cps07\"","Pattern match: \"http://crl.thawte.com/thawtepca-g3.crl0\"","Pattern match: \"https://www.alphassl.com/repository/03\"","Pattern match: \"http://crl.globalsign.net/root.crl0=\"","Pattern match: \"http://ocsp.globalsign.com/rootr10\"","Pattern match: \"http://g1.symcb.com/crls/gtglobal.crl0/\"","Pattern match: \"http://g2.symcb.com0l\"","Pattern match: \"http://www.geotrust.com/resources/cps0\"","Pattern match: \"www.digicert.com1+0\"","Pattern match: \"www.digicert.com1/0-\"","Pattern match: \"http://ocsp.digicert.com0k\"","Pattern match: \"http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=\"","Pattern match: \"https://www.digicert.com/cps0\"","Pattern match: \"https://www.globalsign.com/repository/03\"","Pattern match: \"http://s2.symcb.com0\"","Pattern match: \"http://www.symauth.com/cps0\"","Pattern match: \"http://www.symauth.com/rpa00\"","Pattern match: \"http://s1.symcb.com/pca3-g5.crl0\"","Pattern match: \"www.digicert.com1\"","Pattern match: \"http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=\"","Pattern match: \"crl.usertrust.com/addtrustexternalcaroot.crl05\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\"","Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\"","Pattern match: \"http://s2.symcb.com0k\"","Pattern match: \"http://www.symauth.com/rpa0\"","Pattern match: \"www.verisign.com/cps\"","Pattern match: \"https://www.verisign.com/cps04\"","Pattern match: \"http://crl.verisign.com/pca3.crl0\"","Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\"","Pattern match: \"http://logo.verisign.com/vslogo.gif0\"","Pattern match: \"7www.entrust.net/cps_2048\"","Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\"","Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\"","Pattern match: \"http://cert.startcom.org/policy.pdf05\"","Pattern match: \"http://cert.startcom.org/intermediate.pdf0\"","Pattern match: \"http://cert.startcom.org/policy.pdf0\"","Pattern match: \"http://www.certplus.com/crl/class2.crl0\"","Pattern match: \"http://crl.globalsign.net/root-r2.crl0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\"","Pattern match: \"http://crl.securetrust.com/stca.crl0\"","Pattern match: \"www.entrust.net/legal-terms1907\"","Pattern match: \"http://www.microsoft.com0\"","Pattern match: \"0www.entrust.net/cps\"","Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\"","Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\"","Pattern match: \"http://repository.swisssign.com/0\"","Pattern match: \"www.insidersurveys.windows.com06\"","Pattern match: \"www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0\"","Pattern match: \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t\"","Pattern match: \"www.microsoft.com/pki/certs/microsoftrootcert.crt0\"","Pattern match: \"http://microsoft.com0\"","Heuristic match: \"system.activityhistory.id\"","Heuristic match: \"system.identityprovider.name\"","Heuristic match: \"system.sam.name\"","Heuristic match: \"system.structuredquery.virtual.cc\"","Heuristic match: \"system.structuredquery.virtual.to\"","Heuristic match: \"system.structuredquery.is\"","Heuristic match: \"system.protocol.name\"","Heuristic match: \"system.appusermodel.id\"","Heuristic match: \"system.structuredquerytype.implicit.is\"","Heuristic match: \"essayer ou contacter le support.gog.com\"","Heuristic match: \"z support.gog.com\"","Pattern match: \"remote-config.gwent.cn/components/webinstaller/clients/\"","Heuristic match: \"ttps://insights-collector.gog.com\"","Heuristic match: \">backgroundworkerdownload.name\"","Heuristic match: \">buttonerrorexit.name\"","Heuristic match: \">labelprogresssize.name\"","Heuristic match: \">labelprogressstats.name\"","Heuristic match: \">labelwelcome.name\"","Heuristic match: \">panelerrorgraybackground.name\"","Heuristic match: \">tabcontrolmain.name\"","Heuristic match: \">tabdone.name\"","Heuristic match: \">taberror.name\"","Pattern match: \"support.gog.com/hc/en-us/articles/360010216193\"","Heuristic match: \"qsomething went wrong. please try to download the installer again, if the problem persists contact support.gog.com\"","Heuristic match: \"kf.gaeamobile.net\"","Pattern match: \"www.digicert.com110/\"","Pattern match: \"http://crl3.digicert.com/sha2-assured-cs-g1.crl05\"","Pattern match: \"http://crl4.digicert.com/sha2-assured-cs-g1.crl0l\"","Pattern match: \"http://ocsp.digicert.com0n\"","Pattern match: \"cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0\"","Pattern match: \"cacerts.digicert.com/digicertassuredidrootca.crt0\"","Pattern match: \"crl4.digicert.com/digicertassuredidrootca.crl0\"","Pattern match: \"crl3.digicert.com/digicertassuredidrootca.crl0o\"","Pattern match: \"crl3.digicert.com/digicertassuredidca-1.crl08\"","Pattern match: \"crl4.digicert.com/digicertassuredidca-1.crl0w\"","Pattern match: \"cacerts.digicert.com/digicertassuredidca-1.crt0\"","Pattern match: \"http://www.digicert.com/ssl-cps-repository.htm0\"","Heuristic match: \"algo deu errado. por favor, tente fazer download do instalador novamente, se o problema persistir, entre em contato com support.gog.com\"","Heuristic match: \"me persiste, contactez support.gog.com\"","Heuristic match: \"dgog.com\"","Heuristic match: \"ystem.activityhistory.id\"","Heuristic match: \"ystem.appusermodel.id\"","Heuristic match: \"ystem.identityprovider.name\"","Heuristic match: \"ystem.protocol.name\"","Heuristic match: \"ystem.sam.name\"","Heuristic match: \"ystem.structuredquery.is\"","Heuristic match: \"ystem.structuredquery.virtual.cc\"","Heuristic match: \"ystem.structuredquery.virtual.to\"","Heuristic match: \"ext=.com\"","Pattern match: \"microsoft.net/framework64/v4.0.30319/\"","Heuristic match: \"xyingog.com\"","Heuristic match: \"xycontent-system.gog.com\"","Heuristic match: \"ontent-system.gog.com\"","Heuristic match: \"uibsegoeuisl.tt\"","Heuristic match: \"

>$this.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">>backgroundworkerdownload.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">>backgroundworkerrunsetup.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">>buttonerrorexit.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"belerror.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rogresssize.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"essstats.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aybackground.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oad.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"d.name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"%allusersprofile%\\gog.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"gog.com/galaxy\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"gog.com/galaxy/logs\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://gog-cdn-fastly.gog.com/open/galaxy/client/setup_galaxy_2.0.90.23.exex-cache-adn-ttl\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"og.com/galaxy/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"gog.com/galaxy/logs/installerbootstrapper.log\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"remote-config.gog.com/components/webinstaller?component_version=2.0.0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"emote-config.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"og.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ttps://login.live.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \".sni.global.fastly.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ntrust.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.comodoca.com/comodorsacertificationauthority.crl0q\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crt.comodoca.com/comodorsaaddtrustca.crt0$\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.comodoca.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crt.usertrust.com/usertrustrsaaddtrustca.crt0%\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.usertrust.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://certs.godaddy.com/repository/1301\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.godaddy.com/05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.godaddy.com/gdroot-g2.crl0f\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://certs.godaddy.com/repository/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.thawte.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.thawte.com/cps07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.thawte.com/thawtepca-g3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.alphassl.com/repository/03\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.net/root.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.globalsign.com/rootr10\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://g1.symcb.com/crls/gtglobal.crl0/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://g2.symcb.com0l\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.geotrust.com/resources/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1+0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1/0-\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.digicert.com0k\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.digicert.com/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.globalsign.com/repository/03\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s2.symcb.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/rpa00\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s1.symcb.com/pca3-g5.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.usertrust.com/addtrustexternalcaroot.crl05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s2.symcb.com0k\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/rpa0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.verisign.com/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.verisign.com/cps04\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.verisign.com/pca3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://logo.verisign.com/vslogo.gif0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"7www.entrust.net/cps_2048\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/intermediate.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.certplus.com/crl/class2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.net/root-r2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.securetrust.com/stca.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.entrust.net/legal-terms1907\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"0www.entrust.net/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://repository.swisssign.com/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.insidersurveys.windows.com06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/microsoftrootcert.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.activityhistory.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.identityprovider.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.sam.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.virtual.cc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.virtual.to\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.protocol.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.appusermodel.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquerytype.implicit.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"essayer ou contacter le support.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"z support.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"remote-config.gwent.cn/components/webinstaller/clients/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ttps://insights-collector.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">backgroundworkerdownload.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">buttonerrorexit.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">labelprogresssize.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">labelprogressstats.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">labelwelcome.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">panelerrorgraybackground.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">tabcontrolmain.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">tabdone.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \">taberror.name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"support.gog.com/hc/en-us/articles/360010216193\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"qsomething went wrong. please try to download the installer again, if the problem persists contact support.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"kf.gaeamobile.net\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com110/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl3.digicert.com/sha2-assured-cs-g1.crl05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl4.digicert.com/sha2-assured-cs-g1.crl0l\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.digicert.com0n\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"cacerts.digicert.com/digicertassuredidrootca.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl4.digicert.com/digicertassuredidrootca.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl3.digicert.com/digicertassuredidrootca.crl0o\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl3.digicert.com/digicertassuredidca-1.crl08\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl4.digicert.com/digicertassuredidca-1.crl0w\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"cacerts.digicert.com/digicertassuredidca-1.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.digicert.com/ssl-cps-repository.htm0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"algo deu errado. por favor, tente fazer download do instalador novamente, se o problema persistir, entre em contato com support.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"me persiste, contactez support.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"dgog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.activityhistory.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.appusermodel.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.identityprovider.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.protocol.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.sam.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.virtual.cc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.virtual.to\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ext=.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/framework64/v4.0.30319/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"xyingog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"xycontent-system.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ontent-system.gog.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"uibsegoeuisl.tt\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"

9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")","Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")","Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")","Found URL \"https://remote-config.gog.com/components/webinstaller?component_version=2.0.0downloaded\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193xfailed\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193kthis\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193pnot\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193:download\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193xfailed\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193kthis\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193pnot\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found URL \"https://support.gog.com/hc/en-us/articles/360010216193:download\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json11/03\" - Source: \"00000000-00006884.00000000.282210.047E0000.00000002.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,011/03\" - Source: \"00000000-00006884.00000000.282210.047E0000.00000002.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json11/03\" - Source: \"00000000-00006884.00000003.293281.047E0000.00000002.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,011/03\" - Source: \"00000000-00006884.00000003.293281.047E0000.00000002.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000001.283921.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000002.285843.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://remote-config.gog.com/components/webinstaller?component_version=2.0.0downloaded\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193xfailed\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193kthis\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193pnot\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193:download\" - Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://galaxy2-signup.gog.prod/en/?embeddable=true\" - Source: \"00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cp1.3.132.0.32@eckp1.3.132.0.9@eckp1.3.132.0.9ecdp1.3.132.0.8ecdp1.3.132.0.31@eckp1.3.132.0.32ecdp1.3.132.0.33ecdp1.3.132.0.31ecdp1.2.840.10045.3.1.7@eckp1.3.132.0.8@eckp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.33ecdp1.3.132.0.10ecdp1.3.132.0.35ecdp\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193xfailed\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193kthis\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193pnot\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.gog.com/hc/en-us/articles/360010216193:download\" - Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json11/03\" - Source: \"00000000-00006884.00000000.282210.047E0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,011/03\" - Source: \"00000000-00006884.00000000.282210.047E0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000001.284132.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*ldesktop-fvvf82a192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000002.286051.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json11/03\" - Source: \"00000000-00006884.00000003.293281.047E0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,011/03\" - Source: \"00000000-00006884.00000003.293281.047E0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l192.168.0.1255.255.255.255desktop-fvvf82a192.168.0.1255.255.255.255168.255.@dm1x\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0globalsign\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.securetrust.com/stca.crl0x:rr[\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte,\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e+'nzte3e(z,0*0t.crsttp://ocbhv*8tpa2.5.29.12.5.4.3globalsign\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?secom\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-457","type":2,"relevance":1,"name":"Found string related to HTTP headers","description":"$52","description_v2":["Found string \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","Found string \"HTTP/1.1 100 Continue\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")","Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found string \"HTTP/1.1 204 No Content\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"POST /clients/52138777094359967/events HTTP/1.1Content-Type: application/jsonUser-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)Host: insights-collector.gog.comContent-Length: 786Expect: 100-continueConnection: Keep-Alive\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.1 100 Continue\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.1 204 No Content\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-72","type":7,"relevance":3,"name":"GETs files from a webserver (HTTPS)","description":"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip\n deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: remote-config.gog.com\nConnection: Keep-Alive\n\n GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1\nHost: content-system.gog.com\nConnection: Keep-Alive\n","description_v2":["GET /components/webinstaller?component_version=2.0.0 HTTP/1.1","Accept: */*","Accept-Encoding: gzip","deflate","User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","Host: remote-config.gog.com","Connection: Keep-Alive","","GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1","Host: content-system.gog.com","Connection: Keep-Alive",""],"description_v3":[{"type":"text","value":"GET /components/webinstaller?component_version=2.0.0 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"Accept-Encoding: gzip"},{"type":"linebreak"},{"type":"text","value":"deflate"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"},{"type":"linebreak"},{"type":"text","value":"Host: remote-config.gog.com"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: content-system.gog.com"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-20","type":7,"relevance":7,"name":"HTTP request contains Base64 encoded artifacts","description":"\"rw*'\"\n \"^rbz{nk6^\"","description_v2":["\"rw*'\"","\"^rbz{nk6^\""],"description_v3":[{"type":"text","value":"\"rw*'\""},{"type":"linebreak"},{"type":"text","value":"\"^rbz{nk6^\""}],"origin":"Network Traffic","attck_id":"T1132.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-81","type":7,"relevance":5,"name":"High entropy domain detected","description":"Contacted domain: \"insights-collector.gog.com\" has high entropy","description_v2":["Contacted domain: \"insights-collector.gog.com\" has high entropy"],"description_v3":[{"type":"text","value":"Contacted domain: \"insights-collector.gog.com\" has high entropy"}],"origin":"Network Traffic","attck_id":"T1568.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1568/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","description_v2":["Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-98","type":2,"relevance":1,"name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://remote\"","description_v2":["Found HTTPS url \"https://remote\""],"description_v3":[{"type":"text","value":"Found HTTPS url \"https://remote\""}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-66","type":7,"relevance":1,"name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://remote-config.gog.com/components/webinstaller?component_version=2.0.0\n Found HTTPS POST request to https://insights-collector.gog.com/clients/52138777094359967/events\n Found HTTPS GET request to https://content-system.gog.com/open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe","description_v2":["Found HTTPS GET request to https://remote-config.gog.com/components/webinstaller?component_version=2.0.0","Found HTTPS POST request to https://insights-collector.gog.com/clients/52138777094359967/events","Found HTTPS GET request to https://content-system.gog.com/open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe"],"description_v3":[{"type":"text","value":"Found HTTPS GET request to https://remote-config.gog.com/components/webinstaller?component_version=2.0.0"},{"type":"linebreak"},{"type":"text","value":"Found HTTPS POST request to https://insights-collector.gog.com/clients/52138777094359967/events"},{"type":"linebreak"},{"type":"text","value":"Found HTTPS GET request to https://content-system.gog.com/open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-38","type":7,"relevance":3,"name":"Uses HTTPS for communication","description":"HTTPS traffic to \"151.101.1.55\" on port \"443\"\n HTTPS traffic to \"151.101.65.55\" on port \"443\"","description_v2":["HTTPS traffic to \"151.101.1.55\" on port \"443\"","HTTPS traffic to \"151.101.65.55\" on port \"443\""],"description_v3":[{"type":"text","value":"HTTPS traffic to \"151.101.1.55\" on port \"443\""},{"type":"linebreak"},{"type":"text","value":"HTTPS traffic to \"151.101.65.55\" on port \"443\""}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-605","type":13,"relevance":5,"name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file file \"sample.bin\"","description_v2":["YARA signature to detect high entropy file file \"sample.bin\""],"description_v3":[{"type":"text","value":"YARA signature to detect high entropy file file \"sample.bin\""}],"origin":"YARA Signature","attck_id":"T1027.013","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-606","type":13,"relevance":5,"name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00006884\"","description_v2":["YARA signature to detect medium entropy file process \"00000000-00006884\""],"description_v3":[{"type":"text","value":"YARA signature to detect medium entropy file process \"00000000-00006884\""}],"origin":"YARA Signature","attck_id":"T1027.013","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-28","type":13,"relevance":5,"name":"YARA signature match - Possible payload download using Office macros","description":"YARA signature for payload download using Office macros matched on process \"00000000-00005040\"","description_v2":["YARA signature for payload download using Office macros matched on process \"00000000-00005040\""],"description_v3":[{"type":"text","value":"YARA signature for payload download using Office macros matched on process \"00000000-00005040\""}],"origin":"YARA Signature","attck_id":"T1204.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1204/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-104","type":13,"relevance":0,"name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00006884\"\n YARA signature for RC4 encryption matched on process \"00000000-00005040\"","description_v2":["YARA signature for RC4 encryption matched on process \"00000000-00006884\"","YARA signature for RC4 encryption matched on process \"00000000-00005040\""],"description_v3":[{"type":"text","value":"YARA signature for RC4 encryption matched on process \"00000000-00006884\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for RC4 encryption matched on process \"00000000-00005040\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-209","type":13,"relevance":1,"name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","description_v2":["YARA signature matched on R0R instruction used in file \"sample.bin\""],"description_v3":[{"type":"text","value":"YARA signature matched on R0R instruction used in file \"sample.bin\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-531","type":2,"relevance":1,"name":"Contains references to RPC protocol sequence strings","description":"$53","description_v2":["Found string \"B+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"+ncalrpc:[OLE9B03EAC7D5369DF7F8347516653D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"B+ncalrpc:[OLEF5177E782F356B8A946\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000003.293266.057C0000.00000004.mdmp\")","Found string \"+ncalrpc:[OLE1EA064303C9DBDD6ADB202FB255F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"B+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"+ncalrpc:[OLEF5177E782F356B8A942F99A94B1D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"+ncalrpc:[OLE9B03EAC7D5369DF7F8347516653D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"B+ncalrpc:[OLEF5177E782F356B8A946\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005040.00000003.293266.057C0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"+ncalrpc:[OLE1EA064303C9DBDD6ADB202FB255F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1090","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-868","type":2,"relevance":1,"name":"Able to access credential file using Kerberos","description":"$54","description_v2":["Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1558","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1558","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","description_v2":["Found registry query API: \"RegOpenKeyExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","Found registry query API: \"RegQueryValueExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\"","Found registry query API: \"RegQueryValueExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""],"description_v3":[{"type":"text","value":"Found registry query API: \"RegOpenKeyExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueExW\" in file \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\""}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"GOG_Galaxy_2.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GalaxyInstaller.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"GalaxyInstaller.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"$55","description_v2":["Found string \"\\payload.base64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"Failed to decode base64 token. Continuing with installation.\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"Failed to parse base64 token, error [{}]\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"EncodeBase64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"FromBase64String\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"ToBase64String\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"d.base64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"System.Security.EncryptionOwnersDisplay\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.Security.EncryptionOwners\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.OfflineFiles.Encrypted\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"System.ZipFolder.Encrypted\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")","Found string \"Failed to parse base64 token, error [{}]\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"\\payload.base64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"Failed to decode base64 token. Continuing with installation.\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"payload.base64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"EncodeBase64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\\payload.base64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Failed to decode base64 token. Continuing with installation.\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Failed to parse base64 token, error [{}]\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EncodeBase64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"d.base64\" (Indicator: \"base64\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.EncryptionOwnersDisplay\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.EncryptionOwners\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.OfflineFiles.Encrypted\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.ZipFolder.Encrypted\" (Indicator: \".encrypt\"; Source: \"00000000-00005040.00000001.283921.04FF0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Failed to parse base64 token, error [{}]\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\payload.base64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Failed to decode base64 token. Continuing with installation.\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"payload.base64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EncodeBase64\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"$56","description_v2":["Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$57","description_v2":["Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-205","type":2,"relevance":1,"name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-217","type":2,"relevance":1,"name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")","description_v2":["Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00006884.00000000.282210.00712000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"registry-106","type":3,"relevance":3,"name":"Reads system-defined device setup information from registry","description":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","description_v2":["\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"$58","description_v2":["Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")","Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")","Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.029F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Z:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006884.00000000.282210.02D00000.00000004.mdmp, 00000000-00006884.00000001.284132.02D00000.00000004.mdmp, 00000000-00006884.00000002.286051.02D00000.00000004.mdmp, 00000000-00006884.00000003.293281.02D00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-308","type":2,"relevance":1,"name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-407","type":2,"relevance":1,"name":"Contains ability to format disks","description":"Found string \"format specifier '{}' requires signed argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found string \"format specifier '{}' requires numeric argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found string \"format specifier '{}' requires signed argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found string \"format specifier '{}' requires numeric argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"format specifier '{}' requires signed argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"format specifier '{}' requires numeric argument\" (Indicator: \"format \"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1561.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1561/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-132","type":2,"relevance":1,"name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"424500137538,1288,113,,SystemParametersInfoW,user32.dll,\"01:16:22.421\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")","description_v2":["Found reference to API \"424500137538,1288,113,,SystemParametersInfoW,user32.dll,\"01:16:22.421\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"424500137538,1288,113,,SystemParametersInfoW,user32.dll,\"01:16:22.421\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006884.00000003.293281.1EC90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-406","type":2,"relevance":1,"name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006884-00000C2B-3510135172","description_v2":["Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006884-00000C2B-3510135172"],"description_v3":[{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006884-00000C2B-3510135172"}],"origin":"File/Memory","attck_id":"T1529","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1529","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"GOG_Galaxy_2.0.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")","description_v2":["Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"GOG_Galaxy_2.0.exe\")","Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"GOG_Galaxy_2.0.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp, 00000000-00005040.00000003.293266.005C7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-535","type":2,"relevance":0,"name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"GOG_Galaxy_2.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"GalaxyInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"VVE1XYMXFHECK83F1LNWFDENGA70QI5MYTHJMVPZ15YJPBMZFHGHLORFH27OM8SHWUW9KG6KRTGI0QB2ESLQ0FDU8WLWRJSS9CPGZ7KM9FMTFSUW3B4V6A\"; Value: \"E41A0000\")\n \"GalaxyInstaller.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","\"GalaxyInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"VVE1XYMXFHECK83F1LNWFDENGA70QI5MYTHJMVPZ15YJPBMZFHGHLORFH27OM8SHWUW9KG6KRTGI0QB2ESLQ0FDU8WLWRJSS9CPGZ7KM9FMTFSUW3B4V6A\"; Value: \"E41A0000\")","\"GalaxyInstaller.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"VVE1XYMXFHECK83F1LNWFDENGA70QI5MYTHJMVPZ15YJPBMZFHGHLORFH27OM8SHWUW9KG6KRTGI0QB2ESLQ0FDU8WLWRJSS9CPGZ7KM9FMTFSUW3B4V6A\"; Value: \"E41A0000\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"GOG_Galaxy_2.0.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\"GOG_Galaxy_2.0.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1068","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1068","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$59","description_v2":["\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-354","type":2,"relevance":1,"name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","description_v2":["Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")","Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005040.00000003.293266.00401000.00000040.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-23","type":2,"relevance":2,"name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp, Indicator: \"key.com\")","description_v2":["\".getmicrosoftkey.com1&0\" (Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp, Indicator: \"key.com\")","\".getmicrosoftkey.com1&0\" (Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp, Indicator: \"key.com\")"],"description_v3":[{"type":"text","value":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005040.00000000.282002.029F0000.00000004.mdmp, 00000000-00005040.00000001.283921.029F0000.00000004.mdmp, 00000000-00005040.00000002.285843.029F0000.00000004.mdmp, 00000000-00005040.00000003.293266.02A66000.00000004.mdmp, Indicator: \"key.com\")"},{"type":"linebreak"},{"type":"text","value":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006884.00000000.282210.1EC90000.00000004.mdmp, 00000000-00006884.00000001.284132.1EC90000.00000004.mdmp, 00000000-00006884.00000002.286051.1EC90000.00000004.mdmp, 00000000-00006884.00000003.293281.1EC90000.00000004.mdmp, Indicator: \"key.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"GOG_Galaxy_2.0.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","description_v2":["\"GOG_Galaxy_2.0.exe\" was detected as \"UPX v1.25 (Delphi) Stub\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" was detected as \"UPX v1.25 (Delphi) Stub\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"api-1","type":6,"relevance":10,"name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"GalaxyInstaller.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6884)","description_v2":["\"GalaxyInstaller.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6884)"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6884)"}],"origin":"API Call","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"stream-40","type":1,"relevance":10,"name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["Found 40 calls to GetProcAddress@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"Found 40 calls to GetProcAddress@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-7","type":0,"relevance":10,"name":"PE file is packed with UPX","description":"\"GOG_Galaxy_2.0.exe\" has a section named \"UPX0\"\n \"GOG_Galaxy_2.0.exe\" has a section named \"UPX1\"","description_v2":["\"GOG_Galaxy_2.0.exe\" has a section named \"UPX0\"","\"GOG_Galaxy_2.0.exe\" has a section named \"UPX1\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has a section named \"UPX0\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has a section named \"UPX1\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":1,"name":"Section contains high entropy","description":"\"GOG_Galaxy_2.0.exe\" has section name UPX1 with entropy \"7.931120613123535\"","description_v2":["\"GOG_Galaxy_2.0.exe\" has section name UPX1 with entropy \"7.931120613123535\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has section name UPX1 with entropy \"7.931120613123535\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-121","type":1,"relevance":5,"name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-2913-004424F7\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-2914-004360AB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-3007-004362F2\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005040-47000-3062-0045A542\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-3071-0045A4FE\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005040-47000-4459-00457FEC\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-5983-0043353B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125","description_v2":["GetModuleHandleA@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-2913-004424F7","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-2914-004360AB","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-3007-004362F2","GetModuleHandleExW@KERNEL32.DLL at 00000000-00005040-47000-3062-0045A542","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-3071-0045A4FE","GetModuleHandleExW@KERNEL32.DLL at 00000000-00005040-47000-4459-00457FEC","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-5983-0043353B","GetModuleHandleW@KERNEL32.DLL at 00000000-00005040-47000-8440-00432125"],"description_v3":[{"type":"text","value":"GetModuleHandleA@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2908-00436786","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2913-004424F7","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2913-004424F7","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2914-004360AB","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2914-004360AB","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3007-004362F2","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3007-004362F2","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-3062-0045A542","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-3062-0045A542","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-5983-0043353B","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-5983-0043353B","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-8440-00432125","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-8440-00432125","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-133","type":1,"relevance":5,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005040-47000-5017-00434349\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005040-47000-5697-0045FFBD","description_v2":["GetStartupInfoW@KERNEL32.DLL at 00000000-00005040-47000-5017-00434349","GetStartupInfoW@KERNEL32.DLL at 00000000-00005040-47000-5697-0045FFBD"],"description_v3":[{"type":"text","value":"GetStartupInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"string-2","type":2,"relevance":10,"name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"1F0-9C51-005056916AAC}\" (Indicator: \"005056\")","description_v2":["\"1F0-9C51-005056916AAC}\" (Indicator: \"005056\")"],"description_v3":[{"type":"text","value":"\"1F0-9C51-005056916AAC}\" (Indicator: \"005056\")"}],"origin":"File/Memory","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":0,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","description_v2":["2/26 Antivirus vendors marked sample as malicious (7% detection rate)"],"description_v3":[{"type":"text","value":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"stream-32","type":1,"relevance":1,"name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00005040-47000-4755-0041EE7C","description_v2":["FindResourceW@KERNEL32.DLL at 00000000-00005040-47000-4755-0041EE7C"],"description_v3":[{"type":"text","value":"FindResourceW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4755-0041EE7C","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4755-0041EE7C","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4755-0041EE7C","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"network-4","type":7,"relevance":5,"name":"POSTs data to a webserver","description":"$5a","description_v2":["\"POST /clients/52138777094359967/events HTTP/1.1","Content-Type: application/json","User-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)","Host: insights-collector.gog.com","Content-Length: 786","$5b","Connection: keep-alive","Server: nginx","Cache-Control: max-age=0","no-cache","no-store","private","x-origin-age: 0","Accept-Ranges: bytes","Via: 1.1 varnish","1.1 varnish","Date: Mon","03 Nov 2025 23:25:04 GMT","X-Served-By: cache-fra-etou8220152-FRA","cache-lax-kwhp1940033-LAX","X-Cache: MISS","MISS","X-Cache-Hits: 0","0 with no response body"],"description_v3":[{"type":"text","value":"\"POST /clients/52138777094359967/events HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Content-Type: application/json"},{"type":"linebreak"},{"type":"text","value":"User-Agent: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)"},{"type":"linebreak"},{"type":"text","value":"Host: insights-collector.gog.com"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 786"},{"type":"linebreak"},{"type":"text","value":"$5c"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"Server: nginx"},{"type":"linebreak"},{"type":"text","value":"Cache-Control: max-age=0"},{"type":"linebreak"},{"type":"text","value":"no-cache"},{"type":"linebreak"},{"type":"text","value":"no-store"},{"type":"linebreak"},{"type":"text","value":"private"},{"type":"linebreak"},{"type":"text","value":"x-origin-age: 0"},{"type":"linebreak"},{"type":"text","value":"Accept-Ranges: bytes"},{"type":"linebreak"},{"type":"text","value":"Via: 1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"1.1 varnish"},{"type":"linebreak"},{"type":"text","value":"Date: Mon"},{"type":"linebreak"},{"type":"text","value":"03 Nov 2025 23:25:04 GMT"},{"type":"linebreak"},{"type":"text","value":"X-Served-By: cache-fra-etou8220152-FRA"},{"type":"linebreak"},{"type":"text","value":"cache-lax-kwhp1940033-LAX"},{"type":"linebreak"},{"type":"text","value":"X-Cache: MISS"},{"type":"linebreak"},{"type":"text","value":"MISS"},{"type":"linebreak"},{"type":"text","value":"X-Cache-Hits: 0"},{"type":"linebreak"},{"type":"text","value":"0 with no response body"}],"origin":"Network Traffic","attck_id":"T1041","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1041","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files (.ini files)","description":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\desktop.ini\"","description_v2":["\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Documents\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Music\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Pictures\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Videos\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Downloads\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\OneDrive\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Searches\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Contacts\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Favorites\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Links\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\%USERNAME%\\Saved Games\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" reads file \"C:\\Users\\desktop.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-23","type":7,"relevance":5,"name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 151.101.1.55 on port 443 is sent without HTTP header\n TCP traffic to 151.101.65.55 on port 443 is sent without HTTP header","description_v2":["TCP traffic to 151.101.1.55 on port 443 is sent without HTTP header","TCP traffic to 151.101.65.55 on port 443 is sent without HTTP header"],"description_v3":[{"type":"text","value":"TCP traffic to 151.101.1.55 on port 443 is sent without HTTP header"},{"type":"linebreak"},{"type":"text","value":"TCP traffic to 151.101.65.55 on port 443 is sent without HTTP header"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-22","type":7,"relevance":10,"name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","description_v2":["Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"],"description_v3":[{"type":"text","value":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"registry-9","type":3,"relevance":7,"name":"Checks warning level of secure to non-secure traffic redirection","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-105","type":6,"relevance":5,"name":"Calls an API possibly used to take screenshots","description":"\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"f010a06\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\"\n \"cx\": \"375\"\n \"cy\": \"19\"}\n \"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"740108f2\"\n \"cx\": \"75\"\n \"cy\": \"23\"}","description_v2":["\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"f010a06\"","\"cx\": \"16\"","\"cy\": \"16\"}","\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\"","\"cx\": \"1\"","\"cy\": \"1\"}","\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\"","\"cx\": \"375\"","\"cy\": \"19\"}","\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"740108f2\"","\"cx\": \"75\"","\"cy\": \"23\"}"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"f010a06\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"16\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"16\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"1\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"1\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"d010810\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"375\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"19\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"740108f2\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"75\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"23\"}"}],"origin":"API Call","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-40","type":6,"relevance":10,"name":"Calls an API typically used for keylogging","description":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","description_v2":["\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}","\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}","\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}","\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}","\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}"},{"type":"linebreak"},{"type":"text","value":"\"GalaxyInstaller.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}"}],"origin":"API Call","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-118","type":1,"relevance":3,"name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00005040-47000-8405-00464BED","description_v2":["GetCommandLineA@KERNEL32.DLL at 00000000-00005040-47000-8405-00464BED"],"description_v3":[{"type":"text","value":"GetCommandLineA@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-131","type":1,"relevance":5,"name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00005040-47000-4415-00415A8B\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005040-47000-5655-0045A63F","description_v2":["GetModuleFileNameW@KERNEL32.DLL at 00000000-00005040-47000-2908-00436786","GetModuleFileNameW@KERNEL32.DLL at 00000000-00005040-47000-4415-00415A8B","GetModuleFileNameA@KERNEL32.DLL at 00000000-00005040-47000-5655-0045A63F"],"description_v3":[{"type":"text","value":"GetModuleFileNameW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-2908-00436786","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00000000-00005040-47000-4415-00415A8B","modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-4415-00415A8B","process":{"name":"GOG_Galaxy_2.0.exe","process_uid":"00000000-00005040","pid":"5040"}},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA@KERNEL32.DLL"},{"type":"pid","pid":"00005040"}],"origin":"Hybrid Analysis Technology","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":{"modal_link":"/bff/report/690939ada9aff495330ff3f7/processes/00000000-00005040/streams/0/00000000-00005040-47000-2908-00436786","name":"GOG_Galaxy_2.0.exe","pid":5040}},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"string-61","type":2,"relevance":10,"name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","description_v2":["\".skype.com1&0\" (Indicator: \"skype.com\")","\"community-stage.skype.com1\" (Indicator: \"skype.com\")"],"description_v3":[{"type":"text","value":"\".skype.com1&0\" (Indicator: \"skype.com\")"},{"type":"linebreak"},{"type":"text","value":"\"community-stage.skype.com1\" (Indicator: \"skype.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"registry-105","type":3,"relevance":5,"name":"Read windows product name from registry","description":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","description_v2":["\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")"],"description_v3":[{"type":"text","value":"\"GalaxyInstaller.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"GOG_Galaxy_2.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")"}],"origin":"Registry Access","attck_id":"T1090.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-0","type":0,"relevance":10,"name":"CRC value set in PE header does not match actual value","description":"\"GOG_Galaxy_2.0.exe\" claimed CRC 1030771 while the actual is CRC 1001949","description_v2":["\"GOG_Galaxy_2.0.exe\" claimed CRC 1030771 while the actual is CRC 1001949"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" claimed CRC 1030771 while the actual is CRC 1001949"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-4","type":0,"relevance":10,"name":"Entrypoint in PE header is within an uncommon section","description":"\"GOG_Galaxy_2.0.exe\" has an entrypoint in section \"UPX1\"","description_v2":["\"GOG_Galaxy_2.0.exe\" has an entrypoint in section \"UPX1\""],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" has an entrypoint in section \"UPX1\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"RegCloseKey\n LoadLibraryA\n VirtualProtect\n GetProcAddress\n ShellExecuteExW\n URLDownloadToFileW","description_v2":["RegCloseKey","LoadLibraryA","VirtualProtect","GetProcAddress","ShellExecuteExW","URLDownloadToFileW"],"description_v3":[{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExW"},{"type":"linebreak"},{"type":"text","value":"URLDownloadToFileW"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthiness","identifier":"api-129","type":6,"relevance":10,"name":"Creates a process in suspended mode (likely for process injection)","description":"\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)","description_v2":["\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\GalaxyInstaller_EgtBu\\GalaxyInstaller.exe\"\" - (UID: 00000000-00005040)"}],"origin":"API Call","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-15","type":7,"relevance":5,"name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\n GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)","description_v2":["Found the following user-agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)"],"description_v3":[{"type":"text","value":"Found the following user-agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)"},{"type":"linebreak"},{"type":"text","value":"GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-56","type":7,"relevance":5,"name":"Found unknown user-agent(s)","description":"Found the following user-agents: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)","description_v2":["Found the following user-agents: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)"],"description_v3":[{"type":"text","value":"Found the following user-agents: GOGWebinstaller/2.0.7376.28529 (Microsoft Windows 10 Pro)"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-74","type":7,"relevance":5,"name":"GETs executable from a webserver (HTTPS)","description":"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1\nHost: content-system.gog.com\nConnection: Keep-Alive\n","description_v2":["GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1","Host: content-system.gog.com","Connection: Keep-Alive",""],"description_v3":[{"type":"text","value":"GET /open_link/download?path=/open/galaxy/client/setup_galaxy_2.0.90.23.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: content-system.gog.com"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"}],"origin":"Network Traffic","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"registry-37","type":3,"relevance":3,"name":"Tries to steal Mail credentials from registry","description":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","description_v2":["\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")","\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")"],"description_v3":[{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")"},{"type":"linebreak"},{"type":"text","value":"\"GOG_Galaxy_2.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")"}],"origin":"Registry Access","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"13.2.7","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["POSTs data to a webserver","Found a string that may be used as part of an injection method"]},{"name":"Stealer/Phishing","details":["Tries to steal Mail credentials from registry"]},{"name":"Fingerprint","details":["Queries kernel debugger information","Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","Queries sensitive IE security settings","Tries to steal Mail credentials from registry","Queries the display settings of system associated file extensions"]},{"name":"Evasive","details":["Possibly tries to implement anti-virtualization techniques using MAC address detection","PE file has a section name known to be used by a packer/protector","Able to check if a debugger is running","Contains ability to terminate a process"]},{"name":"Exploit","details":["GETs/downloads executable files from web server"]},{"name":"Network","details":["GETs executable from a webserver (HTTPS)"]},{"name":"Network Behavior","details":["Contacts 3 domains and 3 hosts"]}],"icon":"$5d","visualization":"$5e","classification":["63.4% (.EXE) UPX compressed Win32 Executable","11.8% (.EXE) Win16 NE executable (generic)","10.5% (.EXE) Win32 Executable (generic)","4.7% (.EXE) OS/2 Executable (generic)","4.6% (.EXE) Generic Win/DOS Executable"],"dns_requests":[{"compromised":false,"domain":"content-system.gog.com","address":"151.101.65.55","ttl":3600,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"insights-collector.gog.com","address":"151.101.65.55","ttl":10800,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"remote-config.gog.com","address":"151.101.65.55","ttl":3600,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]}],"contacted_hosts":[{"compromised":false,"address":"151.101.1.55","port":443,"protocol":"TCP","associated_runtime":[{"name":"gog_galaxy_2.0.exe","pid":"5040"}],"country":"United States","associated_sha256s":[]},{"compromised":false,"address":"151.101.65.55","port":443,"protocol":"TCP","associated_runtime":[{"name":"galaxyinstaller.exe","pid":"6884"}],"country":"United States","associated_sha256s":[]}],"contacted_countries":{"countries":["USA"],"coordinates":[{"origin":{"latitude":"37.3394","longitude":"-121.895"},"destination":{"latitude":"37.7621","longitude":"-122.3971"}},{"origin":{"latitude":"37.3394","longitude":"-121.895"},"destination":{"latitude":"37.7621","longitude":"-122.3971"}}]},"port_infos":[{"port":443,"description":"Hypertext Transfer Protocol over TLS/SSL (HTTPS)"}],"extracted_strings":{"all":[{"value":"ISA9ICJ2NC4wImU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyM0BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBJbnB1dCBkYXRhIHNpemUgaXMgbm90IGEgbXVsdGlwbGUgb2YgNA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ISxvLEYgOSVT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"IV9pc19kb3VibGU=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IUcgIT1EIDo5QmIkVXh1LA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"IVVGe0pQS3UkUDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxHYWxheHlJbnN0YWxsZXJfRWd0QnVcR2FsYXh5SW5zdGFsbGVyLmV4ZSI=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IiwgImVycm9yIjogIg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ijl+JCUkICQq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"InswfSAtIEluc3RhbGFkb3Igd2ViIGRlIEdPRyBHYWxheHk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"In10akFaalhO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Izhmb2lPcz9rOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDU1NDgwMjFkLTllZDctNDU3Zi1iODA4LTI4OWNiZTQ0MjYyZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JGU0QnMpS2Ir","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"JEZ1bmN0aW9u","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuQXV0b1NjYWxlRGltZW5zaW9ucw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JHswfSAtIEluc3RhbGF0b3Igc2llY2lvd3kgR09HIEdhbGF4eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcR09HLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcR09HLmNvbS9HYWxheHk=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcR09HLmNvbS9HYWxheHkvbG9ncw==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JWIgJWQgJUggOiAlTSA6ICVTICVZ","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWQgJUggOiAlTSA6ICVTICVZ","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWQgLyAlbSAvICV5","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUggOiAlTSA6ICVT","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUkgOiAlTSA6ICVTICVw","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JW0gLyAlZCAvICV5","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdQ==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxkZQ==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxlcw==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxlcy1NWA==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxmcg==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxHYWxheHlJbnN0YWxsZXIuZXhl","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxpdA==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxqYQ==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxrbw==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxwbA==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxwdC1CUg==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxyZW1vdGVjb25maWcuanNvbg==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVxydQ==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVx6aA==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEdhbGF4eUluc3RhbGxlcl9FZ3RCdVx6aC1IYW50","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXRFWHRheWVTOmM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXRFWHRkYXRlOmNyZWF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXRFWHRkYXRlOm1vZGlmeQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uV2luZG93cy5Gb3Jtc1x2NC4wXzQuMC4wLjBfX2I3N2E1YzU2MTkzNGUwODlcY29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGlwaGxwYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNlY3VyMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XENSWVBUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXdpbmRpciVcdHJhY2luZw==","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVktJW0tJWQgJUg6JU06JVM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JyBhbHJlYWR5IGV4aXN0cw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"J1snLCAneycsIG9yIGEgbGl0ZXJhbA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KCgsNDQwMDhUQDwsNDg4MCg4QEg8PCw0LDgoPDw0KDw0MCQsMEQ8PDAkPDRIUFA0MDQsNDAoOEBgNDgsODQoODgwPDwgJCBU","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KCkqKywtLi8kQHc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCshTzB0Xlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCxISDptbTpT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFxcXS5pTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEMpIEdPRyBTcC4geiBvLm8uIDIwMjA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEU+KkxUckA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KGZzc2FnaT82IHBuZXRqRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KEgvMDNmNWY3ZjExZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFIpIlR3ITc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KSgyRCIhOEht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KXQ0QmAqQ2Yq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KXdzdWJnMHs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KiBhQG87Jkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"KlYxJSZ8fjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"K3YkeCt2JHh2JCt4diskeHYkK3grJHZ4KyR2eCR2K3grJHZ4JCt2eCt2ICQrdiAkdiAkK3YgKyR2ICQrKyQgdiskIHYkIHYrKyQgdiQrIHYreHYkKyB2JHYkICt2KyAkdiQgKyt4JHYrICR2JHYgKysgJHYkICt2","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"K3w8U1taJC0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LDA8d1JPfjc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LGouQXpTUi0w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LHpCTi9PTTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LHswfSAtIFByb2dyYW1tZSBkJ2luc3RhbGxhdGlvbiBkZSBHT0cgR2FsYXh5","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LS52RSZ0dDsu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LS9pbGwgfmFyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LWJyYXppbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LUM1QzcjT2Uj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LWNvbTphc20udjMiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIj48L3JlcXVlc3RlZEV4ZWN1dGlvbkxldmVsPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+UEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LW1zLXdpbi1udHVzZXItd2luZG93c3RhdGlvbi1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXgwamNhXz8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LiBTa29udGFrdHVqIHNp","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjAuNzM3Ni4yODUyMg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjAuNzM3Ni4yODUyOQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ljk4PCZDRFw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVT8kb3V0cHV0X2FkYXB0ZXJfcHJvdG9jb2xAREBkZXRhaWxAbmxvaG1hbm5AQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVV9DaG9yZUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVV9DcnRfbmV3X2RlbGV0ZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWN0eXBlX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlFeGVjdXRpb25Db250ZXh0QENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlFeGVjdXRpb25SZXNvdXJjZUBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWlucHV0X2FkYXB0ZXJfcHJvdG9jb2xAZGV0YWlsQG5sb2htYW5uQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlSZXNvdXJjZU1hbmFnZXJAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlTY2hlZHVsZXJAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlTY2hlZHVsZXJQcm94eUBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlUaHJlYWRQcm94eUBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlUaHJlYWRQcm94eUZhY3RvcnlAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlUb3BvbG9neUV4ZWN1dGlvblJlc291cmNlQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlUb3BvbG9neU5vZGVAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVUlWaXJ0dWFsUHJvY2Vzc29yUm9vdEBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVW1lc3NhZ2VzX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVW1vbmV5X2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVXRpbWVfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVVRvcG9sb2d5T2JqZWN0QEdsb2JhbENvcmVAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVVRvcG9sb2d5T2JqZWN0QEdsb2JhbE5vZGVAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMGRhYjk4MGZiMzhhOGI0YThlMTZiMjg1YmM4MzQ3NDk+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMGZlN2UwY2JmMzVkNTIwODliOTZjYWIwZDdjN2RhM2I+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMzE1Y2MwMDQ1ZjQ1NGQwODVlYzcwMGRiNWY2YzBlMGM+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfNDAzN2M0MTg5M2U1MDNhZmYwM2Q0MzI1ZGJiZWU3NzQ+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfNTU4ZTJlOWY5NGU3NDU2YzMyMzJiZDc4ZTJkODZiZDM+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfNjk4M2M1M2FhZjYwZmFmN2I3MTc3NjQ3NTk4YjllOGM+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfNzJjMmRiNTMxMzUwZjk1ODRhOGI2MTAxNzdmYTk5ZWY+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfOGYzNjc3MTcwZWM5OTdkZWFhYTcyNzZjMzFjMzY5Nzg+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfOWQzNjIyZTk0MGYwMGUzMDNhYTAwZjNmMGIxODVjMmQ+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfYTAxNTNhMjljYmM2OTYxZGUyNGQ1ZWE0NzFjMWM1ZmM+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfYTA4N2ZmZmY1NmFiMzcyZGFlMDY5N2FmM2FmNjRmYjM+QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfYmFzZUBYJCRWQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfYmFzZUBYQUJWPyRiYXNpY19zdHJpbmdARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBWPyRhbGxvY2F0b3JAREAyQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV8wZGFiOTgwZmIzOGE4YjRhOGUxNmIyODViYzgzNDc0OT5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV8wZmU3ZTBjYmYzNWQ1MjA4OWI5NmNhYjBkN2M3ZGEzYj5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV8zMTVjYzAwNDVmNDU0ZDA4NWVjNzAwZGI1ZjZjMGUwYz5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV80MDM3YzQxODkzZTUwM2FmZjAzZDQzMjVkYmJlZTc3ND5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV81NThlMmU5Zjk0ZTc0NTZjMzIzMmJkNzhlMmQ4NmJkMz5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV82OTgzYzUzYWFmNjBmYWY3YjcxNzc2NDc1OThiOWU4Yz5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV83MmMyZGI1MzEzNTBmOTU4NGE4YjYxMDE3N2ZhOTllZj5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV84ZjM2NzcxNzBlYzk5N2RlYWFhNzI3NmMzMWMzNjk3OD5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWEFCVj8kYmFzaWNfc3RyaW5nQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAM0BAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV85ZDM2MjJlOTQwZjAwZTMwM2FhMDBmM2YwYjE4NWMyZD5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV9hMDE1M2EyOWNiYzY5NjFkZTI0ZDVlYTQ3MWMxYzVmYz5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0Z1bmNfaW1wbEBWPGxhbWJkYV9hMDg3ZmZmZjU2YWIzNzJkYWUwNjk3YWYzYWY2NGZiMz5AQFY/JGFsbG9jYXRvckBIQHN0ZEBAWCQkVkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0lvc2JASEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0xhdW5jaFBhZEBWPyR1bmlxdWVfcHRyQFY/JHR1cGxlQFA4YXN5bmNfbG9nX2hlbHBlckBkZXRhaWxzQHNwZGxvZ0BAQUVYWFpQQVYxMjNAQHN0ZEBAVT8kZGVmYXVsdF9kZWxldGVAVj8kdHVwbGVAUDhhc3luY19sb2dfaGVscGVyQGRldGFpbHNAc3BkbG9nQEBBRVhYWlBBVjEyM0BAc3RkQEBAMkBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX01hbGxvY2FBcnJheUhvbGRlckBQQVZDb250ZXh0QENvbmN1cnJlbmN5QEBAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX01hbGxvY2FBcnJheUhvbGRlckBQQVZldmVudEBDb25jdXJyZW5jeUBAQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX01wdW5jdEBfV0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX01wdW5jdEBEQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX01wdW5jdEBHQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVj8kb3V0cHV0X3N0cmluZ19hZGFwdGVyQERWPyRiYXNpY19zdHJpbmdARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBWPyRhbGxvY2F0b3JAREAyQEBzdGRAQEBkZXRhaWxAbmxvaG1hbm5AQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVj8kcm90YXRpbmdfZmlsZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVj8kc3RkZXJyX3NpbmtAVm11dGV4QHN0ZEBAQHNpbmtzQHNwZGxvZ0BAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVl9fRXhjZXB0aW9uUHRyQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVmFzeW5jX2xvZ2dlckBzcGRsb2dAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVmlucHV0X2J1ZmZlcl9hZGFwdGVyQGRldGFpbEBubG9obWFubkBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVmxvZ2dlckBzcGRsb2dAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpAVnBhdHRlcm5fZm9ybWF0dGVyQHNwZGxvZ0BAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX1JlZl9jb3VudF9vYmpfYWxsb2NAVl9fRXhjZXB0aW9uUHRyQEBVPyRfU3RhdGljQWxsb2NhdG9yQEhAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYWxsb2NhdG9yQF9XQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYWxsb2NhdG9yQERAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zdHJlYW1ARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaXN0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb3N0cmVhbUBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyaW5nc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAVj8kYWxsb2NhdG9yQERAMkBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQmFzaWNNZW1vcnlXcml0ZXJAX1dWPyRhbGxvY2F0b3JAX1dAc3RkQEBAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQmFzaWNNZW1vcnlXcml0ZXJARFY/JGFsbG9jYXRvckBEQHN0ZEBAQGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQmFzaWNXcml0ZXJAX1dAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQmFzaWNXcml0ZXJAREBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQnVmZmVyQF9XQGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kQnVmZmVyQERAZm10QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBfV0RVX01ic3RhdGV0QEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBERFVfTWJzdGF0ZXRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBHRFVfTWJzdGF0ZXRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dF91dGY4QF9XJDBCQVBQUFBAJDBBQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29sbGF0ZUBfV0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29sbGF0ZUBEQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29sbGF0ZUBHQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAR0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTWVtb3J5QnVmZmVyQF9XJDBCUEVAVj8kYWxsb2NhdG9yQF9XQHN0ZEBAQGludGVybmFsQGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kTWVtb3J5QnVmZmVyQEQkMEJQRUBWPyRhbGxvY2F0b3JAREBzdGRAQEBpbnRlcm5hbEBmbXRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbWVzc2FnZXNAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbWVzc2FnZXNAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbWVzc2FnZXNAR0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfZ2V0QF9XVj8kaXN0cmVhbWJ1Zl9pdGVyYXRvckBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfZ2V0QERWPyRpc3RyZWFtYnVmX2l0ZXJhdG9yQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfZ2V0QEdWPyRpc3RyZWFtYnVmX2l0ZXJhdG9yQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfcHV0QF9XVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfcHV0QERWPyRvc3RyZWFtYnVmX2l0ZXJhdG9yQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlfcHV0QEdWPyRvc3RyZWFtYnVmX2l0ZXJhdG9yQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBfVyQwMEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBfVyQwQUBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBEJDAwQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBEJDBBQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBHJDAwQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbW9uZXlwdW5jdEBHJDBBQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX2dldEBfV1Y/JGlzdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX2dldEBEVj8kaXN0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX2dldEBHVj8kaXN0cmVhbWJ1Zl9pdGVyYXRvckBHVT8kY2hhcl90cmFpdHNAR0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBfV1Y/JG9zdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBEVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBHVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBHVT8kY2hhcl90cmFpdHNAR0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAREBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAR0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kb3V0cHV0X3N0cmluZ19hZGFwdGVyQERWPyRiYXNpY19zdHJpbmdARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBWPyRhbGxvY2F0b3JAREAyQEBzdGRAQEBkZXRhaWxAbmxvaG1hbm5AQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kcm90YXRpbmdfZmlsZV9zaW5rQFZtdXRleEBzdGRAQEBzaW5rc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kc3RkZXJyX3NpbmtAVm11dGV4QHN0ZEBAQHNpbmtzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kVGhyZWFkUHJveHlGYWN0b3J5QFZGcmVlVGhyZWFkUHJveHlAZGV0YWlsc0BDb25jdXJyZW5jeUBAQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9nZXRAX1dWPyRpc3RyZWFtYnVmX2l0ZXJhdG9yQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9nZXRARFY/JGlzdHJlYW1idWZfaXRlcmF0b3JARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9nZXRAR1Y/JGlzdHJlYW1idWZfaXRlcmF0b3JAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9wdXRAX1dWPyRvc3RyZWFtYnVmX2l0ZXJhdG9yQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9wdXRARFY/JG9zdHJlYW1idWZfaXRlcmF0b3JARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kdGltZV9wdXRAR1Y/JG9zdHJlYW1idWZfaXRlcmF0b3JAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kd3N0cmluZ19jb252ZXJ0QFY/JGNvZGVjdnRfdXRmOEBfVyQwQkFQUFBQQCQwQUBAc3RkQEBfV1Y/JGFsbG9jYXRvckBfV0AyQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9fbm9uX3J0dGlfb2JqZWN0QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9DYW5jZWxsYXRpb25Ub2tlblJlZ2lzdHJhdGlvbkBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9GYWNldF9iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9JbnRlcnJ1cHRpb25fZXhjZXB0aW9uQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9QYWRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9SZWZfY291bnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9SZWZDb3VudGVyQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmFfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkFfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmFnZ3JlZ2F0ZV9mb3JtYXR0ZXJAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmFzeW5jX2xvZ2dlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkJfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9jYXN0QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9mdW5jdGlvbl9jYWxsQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF90eXBlaWRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNhY2hlTG9jYWxTY2hlZHVsZUdyb3VwQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNhY2hlTG9jYWxTY2hlZHVsZUdyb3VwU2VnbWVudEBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNhbmNlbGxhdGlvblRva2VuUmVnaXN0cmF0aW9uX1Rhc2tQcm9jQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNoX2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvZGVjdnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNvbnRleHRAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbnRleHRfc2VsZl91bmJsb2NrQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvbnRleHRfdW5ibG9ja191bmJhbGFuY2VkQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNvbnRleHRCYXNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkRfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmRfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmVfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkVfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmVycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBkZXRhaWxAbmxvaG1hbm5AQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkV4ZWN1dGlvblJlc291cmNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkV4dGVybmFsQ29udGV4dEJhc2VAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhY2V0QGxvY2FsZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZhaXJTY2hlZHVsZUdyb3VwQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZhaXJTY2hlZHVsZUdyb3VwU2VnbWVudEBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZsYWdfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZvcm1hdEVycm9yQGZtdEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdHRlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZyZWVUaHJlYWRQcm94eUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZyZWVUaHJlYWRQcm94eUZhY3RvcnlAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkZyZWVWaXJ0dWFsUHJvY2Vzc29yUm9vdEBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZ1bGxfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkhfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVklfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmltcHJvcGVyX2xvY2tAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmltcHJvcGVyX3NjaGVkdWxlcl9hdHRhY2hAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmltcHJvcGVyX3NjaGVkdWxlcl9yZWZlcmVuY2VAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlucHV0X2J1ZmZlcl9hZGFwdGVyQGRldGFpbEBubG9obWFubkBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkludGVybmFsQ29udGV4dEJhc2VAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfYXJndW1lbnRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfb3BlcmF0aW9uQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfb3ZlcnN1YnNjcmliZV9vcGVyYXRpb25AQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfc2NoZWR1bGVyX3BvbGljeV9rZXlAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfc2NoZWR1bGVyX3BvbGljeV90aHJlYWRfc3BlY2lmaWNhdGlvbkBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfc2NoZWR1bGVyX3BvbGljeV92YWx1ZUBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlvc19iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxldmVsX2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2dlckBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm1fZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVk1fZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm1pc3Npbmdfd2FpdEBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVk11bHRpV2FpdEJsb2NrQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm5hbWVfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm5lc3RlZF9zY2hlZHVsZXJfbWlzc2luZ19kZXRhY2hAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm90aGVyX2Vycm9yQGRldGFpbEBubG9obWFubkBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBkZXRhaWxAbmxvaG1hbm5AQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhcnNlX2Vycm9yQGRldGFpbEBubG9obWFubkBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhdHRlcm5fZm9ybWF0dGVyQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBpZF9mb3JtYXR0ZXJAZGV0YWlsc0BzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlJfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJhbmdlX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlJlYWxpemVkQ2hvcmVAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlJlc291cmNlTWFuYWdlckBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlR3JvdXBAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlR3JvdXBCYXNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlR3JvdXBTZWdtZW50QmFzZUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlckBDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlcl9yZXNvdXJjZV9hbGxvY2F0aW9uX2Vycm9yQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNjaGVkdWxlcl93b3JrZXJfY3JlYXRpb25fZXJyb3JAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlckJhc2VAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNjaGVkdWxlclByb3h5QGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNob3J0X2xldmVsX2Zvcm1hdHRlckBkZXRhaWxzQHNwZGxvZ0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNpbmdsZVdhaXRCbG9ja0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNpbmtAc2lua3NAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnNwZGxvZ19leEBzcGRsb2dAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfY29uY3J0QGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfaW50ZXJmYWNlQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfdmlzdGFAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jb25kaXRpb25fdmFyaWFibGVfd2luN0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX2NvbmNydEBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX2ludGVyZmFjZUBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX3Zpc3RhQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN0bF9jcml0aWNhbF9zZWN0aW9uX3dpbjdAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnRfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRocmVhZEludGVybmFsQ29udGV4dEBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRocmVhZFByb3h5QGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRocmVhZFNjaGVkdWxlckBkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRocmVhZFZpcnR1YWxQcm9jZXNzb3JAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlRpbWVkU2luZ2xlV2FpdEJsb2NrQGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfZXJyb3JAZGV0YWlsQG5sb2htYW5uQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnVuc3VwcG9ydGVkX29zQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnZfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlZpcnR1YWxQcm9jZXNzb3JAZGV0YWlsc0BDb25jdXJyZW5jeUBA","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlZpcnR1YWxQcm9jZXNzb3JSb290QGRldGFpbHNAQ29uY3VycmVuY3lAQA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVldhaXRBbGxCbG9ja0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVldhaXRBbnlCbG9ja0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVldhaXRCbG9ja0BkZXRhaWxzQENvbmN1cnJlbmN5QEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVllfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnpfZm9ybWF0dGVyQGRldGFpbHNAc3BkbG9nQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LmNvbSwgYWJ5IHV6eXNrYQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTEE=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTFo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LmQ0Y2gxMTAvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkRIZTN+b18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHg=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcms=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgbmljaHQgZ2VmdW5kZW4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgbm8gZW5jb250cmFkbw==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBGcmFtZXdvcmsgTm90IEZvdW5k","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lk5FVCBmcmFtZXdvcmsgbm90IGZvdW5kIC0gc3lzdGVtIG5vdCBzdWl0YWJsZSBmb3IgR2FsYXh5IGluc3RhbGwu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LnB5UWB1ZHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LlRhYkluZGV4","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L2NsaWVudHMvNTIxMzg3NzcwOTQzNTk5NjcvZXZlbnRz","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L2NvbXBvbmVudHMvd2ViaW5zdGFsbGVyP2NvbXBvbmVudF92ZXJzaW9uPTIuMC4w","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L2VuLXVzL2FV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2dhbWVfbmFtZT0i","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L29wZW5fbGluay9kb3dubG9hZD9wYXRoPS9vcGVuL2dhbGF4eS9jbGllbnQvc2V0dXBfZ2FsYXh5XzIuMC45MC4yMy5leGU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L3hYTXNnVGwz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCI4I0AkSCUjRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMTAyMDMwNDA1MDYwNzA4MDkxMDExMTIxMzE0MTUxNjE3MTgxOTIwMjEyMjIzMjQyNTI2MjcyODI5MzAzMTMyMzMzNDM1MzYzNzM4Mzk0MDQxNDI0MzQ0NDU0NjQ3NDg0OTUwNTE1MjUzNTQ1NTU2NTc1ODU5NjA2MTYyNjM2NDY1NjY2NzY4Njk3MDcxNzI3Mzc0NzU3Njc3Nzg3OTgwODE4MjgzODQ4NTg2ODc4ODg5OTA5MTkyOTM5NDk1OTY5Nzk4OTk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OS0=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OS0rRWU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OS0rbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRmFiY2RlZi0rWHg=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRmFiY2RlZi0rWHhQcA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDc2N0EwMzYtMEQyMi00OGFhLUJBNjktQjYxOTQ4MEYzOENC","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDc2N2EwMzYtMGQyMi00OGFhLWJhNjktYjYxOTQ4MGYzOGNiQG5jYWxycGM6","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MFxpXG9iaixBTEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEJfT2duWHI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEo8S0hMOXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTAyMDMwNDA1MDYwNzA4MGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTQuMC4wLjA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MTc4MTYyNTYxMg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MTh4J11Nw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTwsdC08L3Ux","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MWQtOWVkNy00bg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Mi4wLjAuMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjEwNDI5MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjIwODAxMDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjUwMjE5MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjUwNTA3MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjUwNjA0MDAwMDAwWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjUwNzMxMTAyMDMyWjAv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjYwMjE4MjM1OTU5WjBoMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjY1ZjNhYzctNTZhNS01NzIwLTBhZjgtNzYxNmExYWYzZDlk","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MkRpZ2lDZXJ0IFNIQTI1NiBSU0E0MDk2IFRpbWVzdGFtcCBSZXNwb25kZXIgMjAyNSAxMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Mmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRSb290RzQuY3JsMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzExMTA5MjM1OTU5WjBiMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzE5ZGM0NDktYWRhNS01MGY3LTQyOGUtOTU3ZGI2NzkxNjY4","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI0MjUyNjI3MjgyOWhEIDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzU5OTY3L2V2ZW50cw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzYwNDI4MjM1OTU5WjBpMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzYwOTAzMjM1OTU5WjBjMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzgwMTE0MjM1OTU5WjBpMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzhlZDM2MzMtNWUzZi01OTg5LWJmMjUtZjBiMWIzMzE4Yzli","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2V1aVVwZGFRMjZPbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NC4wLjAuMA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NGFtb2RpZnlQeT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NENNdHVAKGs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NGUxSG91ci1iUmA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NHJycnJYYmx2ZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NS0wNlQxMjoyNzozNisw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NS4jKCMrMClo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTEzOGI5YS01ZDlmYmQt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTQ2NDc0ODQ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTdmLWIgOC0yODljYmU0NDI2Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRSb290RzQuY3J0MEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjBOXmVVNil8bHY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjkwNmU2ZTEtZjljZC01YjNiLWM4NDYtMjc1NzhmZDhkNjll","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NktSLFA4S19oZWxwKQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzYzZmQ3NTQtNzA4Ni00ZGZlLTk1ZWItYzAxYTQ2ZmFmNGNh","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Nzw/eG1sQT0iMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"N2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"N21Fc3NnWTYnSG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCBkNDgkQDg0QFh4Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODM2ZDlkMzctNDZjMS00MWJlLWE5NTYtMDliODhmOTY0NDY4","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0Ex","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0Ex","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OGU5ZjUwOTAtMmQ3NS00ZDAzLThhODEtZTVhZmJmODVkYWYx","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OTEwMTIxMzE0MTUxNjE3MTgxOUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTYxYzE1MWQyZTg3ZjI2ODZhOTU1YTliZTI0ZDMxNmYxMzYyYmYyMSAzLjEuMg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OWRPeChwakc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUw0WDVkNnA3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OXlubDJLaCM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiBBcHBsaWNhdGlvbkV4aXRDYWxs","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjhrS21FaUNx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"OkFNOmFtOlBNOnBt","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OkQyfTp7MjpEMn0=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OkphbjpKYW51YXJ5OkZlYjpGZWJydWFyeTpNYXI6TWFyY2g6QXByOkFwcmlsOk1heTpNYXk6SnVuOkp1bmU6SnVsOkp1bHk6QXVnOkF1Z3VzdDpTZXA6U2VwdGVtYmVyOk9jdDpPY3RvYmVyOk5vdjpOb3ZlbWJlcjpEZWM6RGVjZW1iZXI=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OlNlcDpTZXB0ZW1iZXI6T2N0Ok9jdG9iZXI6Tm92Ok5vdmVtYmVyOkRlYzpEZWNlbWJlcg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OlN1bjpTdW5kYXk6TW9uOk1vbmRheTpUdWU6VHVlc2RheTpXZWQ6V2VkbmVzZGF5OlRodTpUaHVyc2RheTpGcmk6RnJpZGF5OlNhdDpTYXR1cmRheQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OyBleHBlY3RlZA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OyBsYXN0IHJlYWQ6ICc=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OyleXE3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"O0IkdncmWF5BTF4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"O05cdVwiclNN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDB3IF9Cen0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD40X190aGlz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PD45X18zMF8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MzM18w","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$5f","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$60","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEFWXXk9YCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGJhc2VzPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGNvbmZpZ3VyYXRpb24+PHN0YXJ0dXA+PHN1cHBvcnRlZFJ1bnRpbWUgdmVyc2lvbiA9ICJ2NC4wIi8+PHN1cHBvcnRlZFJ1bnRpbWUgdmVyc2lvbiA9ICJ2Mi4wLjUwNzI3Ii8+PC9zdGFydHVwPjwvY29uZmlndXJhdGlvbj4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGNvbnRlbnQ+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGRlcHJlY2F0ZWQ+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGRpc2NhcmBkPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGRpc2NhcmRlZD4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGRvd25sb2FkTGluaz5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEdldFJlbW90ZUNvbmZpZ0pzb24+Yl9fMzBfMA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEd1aVVwZGF0ZT5iX18yNl8w","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGluc3RhbGxlck1kNT5rX19CYWNraW5nRmllbGQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGxhbWJkYWhA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PG5hbWVfc3BhY2U+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PG9KL1YuLSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PE9uRXJyb3I+Yl9fNDZfMA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE9uRXJyb3I+Yl9fNDZfMQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHBhcnNlIGVycm9yPg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFIyJikoPTQ6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHNlcnZlcl9hZGRyZXNzPmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHNpemU+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHVuaW5pdGlhbGl6ZWQ+","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHZlcnNpb24+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHdlYkNsaWVudF9Eb3dubG9hZFByb2dyZXNzQ2hhbmdlZD5iX18w","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHdlYmluc3RhbGxlckV2ZW50PmtfX0JhY2tpbmdGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHdpbmRvd3M+a19fQmFja2luZ0ZpZWxk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PURzUSRvUi9tUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PXMiKWFqR0tEPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"$61","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PjxzdXBwb3J0ZWRSdW50aW1lIHZlcnNpb24gPSAidjQuMCIvPjxzdXBwb3J0ZWRSdW50aW1lIHZlcnNpb24gPSAidjIuMC41MDcyNyIvPjwvc3RhcnR1cD48L2NvbmZpZ3VyYXRpb24+","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj4kdGhpcy5OYW1l","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5iYWNrZ3JvdW5kV29ya2VyRG93bmxvYWQuTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5iYWNrZ3JvdW5kV29ya2VyUnVuU2V0dXAuTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5idXR0b25FcnJvckV4aXQuTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5sYWJlbFdhaXRFbmQuWk9yZGVy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5sYWJlbFdlbGNvbWUuUGFyZW50","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5sYWJlbFdlbGNvbWUuWk9yZGVy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj5saW5rVVJMLlpPcmRlcg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJDb250cm9sTWFpbi5QYXJlbnQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJDb250cm9sTWFpbi5aT3JkZXI=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJFcnJvci5QYXJlbnQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJFcnJvci5aT3JkZXI=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJJbml0LlBhcmVudA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj50YWJJbml0LlpPcmRlcg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PkN1NDx+Siw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"PmxhYmVsV2FpdEVuZC5QYXJlbnQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pyp7WlNwYXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Py9naGlqa2xtbm9wcXJzdHV2d3h5eg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"P1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"P2cpKFt8WD49","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xJZWRQLnZpbGVn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"P3l5eHdycnI7dm92dXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QDBZeWkncCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQD5AQEA/NDU2Nzg5Ojs8PUBAQEBAQEA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WyoqKiBMT0cgRVJST1IgKioqXSBbe31dIFt7fV0gW3t9XXt9","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$62","type":"Ansi","source":"File String Dumps","process":null,"filename":"InstallerWebinstaller.log","compromised":null,"detection_total":null,"total":null},{"value":"W2pzb24uZXhjZXB0aW9uLg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"W3t9XS4gRXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XChULC5Dcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"XDM2MzczODM5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"XF5NOls6Onk1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"XEdhbGF4eUluc3RhbGxlci5leGU=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XEdhbGF4eUluc3RhbGxlci5leGUuY29uZmln","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XEdhbGF4eVdlYkluc3RhbGxlci5yZXNvdXJjZXMuZGxs","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGdvZ0dhbGF4eS5hdXRo","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGljb24uaWNv","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGljb24ucG5n","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHBheWxvYWQuYmFzZTY0","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHBheWxvYWQuY2FtcGFpZ24=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHJlbW90ZWNvbmZpZy5qc29u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHUlMDR4XHUlMDR4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XnJientuazZe","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"XnM5Sj9gdmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZG91Ymxl","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZmxvYXQ=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2NhbXBhaWduUGF5bG9hZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NhbmNlbERvd25sb2Fk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NoInJzM2w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckRsbE1haW4=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2RhdGFEb3dubG9hZGVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2RlY29kZWRQYXlsb2Fk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Rvd25sb2FkU3BlZWRTbmFwc2hvdHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2VuY29kZWRQYXlsb2Fk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Vycm9yX3VybA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2dhbWVOYW1l","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2d1aVJlZnJlc2hUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2lzX2RvdWJsZQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2xvZ0ZvbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X25bSDw5OTk1Iw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3Byb2R1Y3RJZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3JlbW90ZUNvbmZpZ0Rvd25sb2FkVVJM","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3JlbW90ZUNvbmZpZ0Vudmlyb21lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3JlbW90ZUNvbmZpZ0pzb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3JlbW90ZUNvbmZpZ0xvY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3JlbW90ZUNvbmZpZ1ZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3Nlc3Npb25JZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3N0b3BXYXRjaA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3N0b3B3YXRjaEVsYXBzZWRPbkxhc3RUaWNr","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3RvdGFsRGF0YVRvRG93bmxvYWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1RyYWNrTW91c2VFdmVudA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X3dlYkNsaWVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGR7ZTIwMTE0NTctMTU0Ni00M2M1fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YE8tIT9TN1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YSB3cml0dGVuIHRvIGZpbGUgW3t9XSBkb2VzIG5vdCBtYXRjaCBleHBlY3RlZCBzaXplLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YTY2OTAyMWMtYzQ1MC00NjA5LWEwMzUtNWFmNTlhZjRkZjE4","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QUBnMSlMNXc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QV1OcFh7RW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGYWJjZGVmNlh4RXgx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJDb250cm9sTWFpbi5JdGVtU2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJDb250cm9sTWFpbi5NYXJnaW4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJEb25lLlRhYkluZGV4","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJlbFdlbGNvbWUuTWFyZ2lu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJJbml0LlNpemU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWJvcnRNc2dCb3g=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWJvdXQgLi4u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWJvdXQgSW5zdGFsbGVyQm9vdHN0cmFwcGVy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUMgTUUgT3B0c0UgNiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXNzIHZpb2xhdGlvbiAtIG5vIFJUVEkgZGF0YSE=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZUNyZWRlbnRpYWxzSGFuZGxlVw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWQuY2FtcGFpZ24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclRpbWVvdXRMaW1pdA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0NsaWNr","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0RlYWN0aXZhdGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Rvd25sb2FkRmlsZUNvbXBsZXRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Rvd25sb2FkUHJvZ3Jlc3NDaGFuZ2Vk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0RvV29yaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0VsYXBzZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Zvcm1DbG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0xpbmtDbGlja2Vk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1J1bldvcmtlckNvbXBsZXRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRkckNvbmZpZ0NvbnRyb2w=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBmYW1pbHkgbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBpbiB1c2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBub3QgYXZhaWxhYmxl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRpbmcgY2FtcGFpZ24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWRpdGlvbmFs","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5FbGV2YXRpb25EZW5pZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YUUrREMwMC4u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWVwJU9jdFZvdmVjeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUVQLjxobGV6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWl0RW5kLlNpemU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxheHkgLSBXZWIgSW5zdGFsbGVy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxheHkgMi4wIHN1Y2NlZWRlZC4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxheHkgaW5zdGFsbGVyIE1ENSBkbyBub3QgbWF0Y2ggcmVtb3RlLWNvbmZpZyBkYXRh","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxheHkgSW5zdGFsbGVyOg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxibyB6YWN6ZWthaiBh","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxnbyBkZXUgZXJyYWRvIGFvIGluc3RhbGFyIG8gR09HIEdhbGF4eS4gUG9yIGZhdm9yLCB0ZW50ZSBub3ZhbWVudGUgb3UgZW50cmUgZW0gY29udGF0byBjb20gc3VwcG9ydC5nb2cuY29t","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxsZXIuZXhl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxsZXIucmVzb3VyY2VzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dBbGxVcmlFbmNvZGluZ0V4cGFuc2lvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEYW5nZXJvdXNVbmljb2RlRGVjb21wb3NpdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGaWxlQ0xTSURKdW5jdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dVbnF1YWxpZmllZFF1ZXJ5","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWxyZWFkeSBjb25uZWN0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW06UHBtd0lrcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW1ld29yayBOb3QgRm91bmQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW4tbHV4ZW1ib3VyZw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW5ndWFnZSBpcw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vdGhlciBHT0cgR2FsYXh5IGluc3RhbGxlciBpcyBhbHJlYWR5IHJ1bm5pbmcuIFBsZWFzZSBjbG9zZSB0aGUgcHJldmlvdXMgaW5zdGFsbGF0aW9uIG9yIHdhaXQgZm9yIGl0IHRvIGZpbmlzaC4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0x","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kVG9NdWx0aUxhYmVsTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwZXIubG9n","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25TZXR0aW5nc0Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbHlSZXNvdXJjZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0Q2xyQ29tcGF0","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJnIGxpc3QgdG9vIGxvbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJnZW50aW5h","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgaW5kZXggb3V0IG9mIHJhbmdl","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbGlzdCB0b28gbG9uZw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbm90IGZvdW5k","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgb3V0IG9mIGRvbWFpbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJ0aW5nIGNsaWVudCBkb3dubG9hZC4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzdW1pbmcgdGhhdCBzeXN0ZW0gaXMgMzIgYml0Lg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXN5bmMgbG9nZ2VyIHF1ZXVlIHNpemUgbXVzdCBiZSBwb3dlciBvZiB0d28=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDb21wbGV0ZWRFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDb21wbGV0ZWRFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRpb24gc2hvdWxkIHByb2NlZWQgYXMgbm9ybWFsLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRvciBHT0cgR2FsYXh5IGp1","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoRmlyc3REZWx0YVNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoTmV4dERlbHRhU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Byb3h5QXV0b0xvZ29uSWZDaGFsbGVuZ2Vk","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Byb3h5UXVlcnlXaXRoRnVsbFVybA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVdiVyBXIEJjVyBXIENE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXh5IC0gV2ViIEluc3RhbGxlcg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXh5U2V0dXAuZXhl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXh5V2ViSW5zdGFsbGVyLmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXh5V2ViSW5zdGFsbGVyLnJlc291cmNlcy5kbGw=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXlCYWNrZ3JvdW5kLk5hbWU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YiBJbnN0YWxsZXIgcmVxdWlyZXMgLk5FVCBGcmFtZXdvcmsgdG8gcHJvY2VlZC4gQ29udGFjdCBzdXBwb3J0LmdvZy5jb20gZm9yIGFzc2lzdGFuY2Uu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YjI0ZDMxNmYxMzYyYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YjNmbFIlc0w4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Yjc3YTVjNTYxOTM0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmE/YF9yOzk5X15db10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFja2dyb3VuZC5UeXBl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFja2dyb3VuZFdvcmtlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlckRvd25sb2Fk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlckRvd25sb2FkX0RvV29yaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlckRvd25sb2FkX1J1bldvcmtlckNvbXBsZXRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlclJ1blNldHVw","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlclJ1blNldHVwX0RvV29yaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFja2dyb3VuZFdvcmtlclJ1blNldHVwX1J1bldvcmtlckNvbXBsZXRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFkIGFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFycmF5IG5ldyBsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGNvbnZlcnNpb24=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFkIGR5bmFtaWNfY2FzdCE=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGZpbGUgZGVzY3JpcHRvcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFkIGZpbGUgZGVzY3JpcHRvcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGZ1bmN0aW9uIGNhbGw=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGxvY2FsZSBuYW1l","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIG1lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBBcnJheSc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YkNvbnRyb2xNYWluLlNpemU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YkRvbmUuUGFyZW50","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YkRvd25sb2FkLlBhcmVudA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5QYWludA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmVpIGRlciBJbnN0YWxsYXRpb24gdm9uIEdPRyBHYWxheHkgaXN0IGVpbiBGZWhsZXIgYXVmZ2V0cmV0ZW4uIEJpdHRlIHZlcnN1Y2hlIGVzIGVybmV1dCBvZGVyIGtvbnRha3RpZXJlIHN1cHBvcnQuZ29nLmNvbS9oYy9kZQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVsRXJyb3IuTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ymluc3RhbGxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ym9vdHN0cmFw","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnJva2VuIHBpcGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnJva2VuIHBpcGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YnMtYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnNfR1dFTlRfQ04=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QlNKdEcxWSI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QnV0dG9uQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnV0dG9uRG93bmxvYWRBYm9ydA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnV0dG9uRG93bmxvYWRBYm9ydF9DbGljaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnV0dG9uRXJyb3JFeGl0LlR5cGU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnV0dG9uRXJyb3JFeGl0X0NsaWNr","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Qnl0ZXMgd3JpdHRlbiB0byBmaWxlIFt7fV0gZG9lcyBub3QgbWF0Y2ggZXhwZWN0ZWQgc2l6ZS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Qnl0ZXMgd3JpdHRlbiB0byBmaWxlIFt7fV0gZG9lcyBub3QgbWF0Y2ggZXhwZWN0ZWQgc2l6ZS4gV3JpdHRlbiBbe31dLCBleHBlY3RlZCBbe31d","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QyMgSW5zdGFsbGVyIHJldHVybmVkIG5vbnplcm8gZXJyb3IgY29kZS4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YzRGOTNlNWg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QzhmRkwwZWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"QzovUHJvZ3JhbURhdGE=","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzovUHJvZ3JhbURhdGEvR09HLmNvbS9HYWxheHkvbG9ncy8=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QzpcR09HX0dhbGF4eV8yLjAuZXhl","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2A0JyVvaFg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVBbGxDb21wYXJ0bWVudHM=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVWZXJpZnk=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbExlZ2FjeVdDTVBvbGljaWVz","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2FtcGFpZ24gZnJvbSBqc29uLCBlcnJvciBbe31dLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQXN5bmM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRG93bmxvYWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXZlbnRBcmdz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2Fubm90IHN3aXRjaCBmcm9tIGF1dG9tYXRpYyB0byBtYW51YWwgYXJndW1lbnQgaW5kZXhpbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2Fubm90IHN3aXRjaCBmcm9tIG1hbnVhbCB0byBhdXRvbWF0aWMgYXJndW1lbnQgaW5kZXhpbmc=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2Fubm90IHVzZSBvcGVyYXRvcltdIHdpdGg=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IHVzZSBzaXplKCkgb24gY2xvc2VkIGZpbGU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FwYWJpbGl0aWVz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2F0ZWdvcnk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2F0aW9uVHlwZSI6ICJXZWJpbnN0YWxsZXIiLCAid2ViSW5zdGFsbGVyVmVyc2lvbiI6ICI=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2MyYmNiYmEtMTZiNi00Y2YzLTg5OTAtZDc0YzJlOGFmNTAw","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZENlcnRpZmljYXRlTGlua1RvU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZENlcnRpZmljYXRlTGlua1RvU3RvcmVX","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENsb3NlU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ2hhaW5X","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZVN0b3JlVw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3Jl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3JlVw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNoYWlu","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW5X","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydE9wZW5TdG9yZQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydE9wZW5TdG9yZVc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeUNlcnRpZmljYXRlQ2hhaW5Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeUNlcnRpZmljYXRlQ2hhaW5Qb2xpY3lX","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2Vzc2l0ZSBsZSBmcmFtZXdvcmsgLk5FVCBwb3VyIHBvdXJzdWl2cmUuIENvbnRhY3RleiBsZSBzdXBwb3J0LmdvZy5jb20gcG91ciBvYnRlbmlyIHVuZSBhc3Npc3RhbmNlLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5DYWNoZVJlc3luY0ZpbGV0aW1l","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2Rl","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2RlR0NN","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGltZXJRdWV1ZVRpbWVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tpbmcgZ2FsYXh5IGV4aXN0ZW5jZS4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2tncm91bmQuU2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NpY1NoZWxs","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYW5pbmcgdGVtcG9yYXJ5IGZvbGRlciBhdCBbe31dLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0xJRU5UX0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50Q2FjaGVTaXpl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2xpZW50RXhlY3V0YWJsZQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xMKW1uRXN1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0xSTG9hZExvZ0Rpcg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29kZWQgcGF5bG9hZA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRJbnN0YW5jZUZyb21GaWxl","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRJbnN0YW5jZUZyb21JU3RvcmFnZQ==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tYmFzZS5kbGw=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcG9uZW50UmVzb3VyY2VNYW5hZ2Vy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29tcG9uZW50cw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZUhhc2g=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tVmlzaWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiBhYm9ydGVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiBhbHJlYWR5IGluIHByb2dyZXNz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiByZWZ1c2Vk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29ubmVjdGlvbiByZXNldA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29uc29sZVRyYWNpbmdNYXNr","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFpbmVyQ29udHJvbA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29udGVudC1zeXN0ZW0uZ29nLmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dFByaW9yaXR5","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dFN0YWNrU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29udGludWFyZS4gUGVyIHJpY2V2ZXJlIGFzc2lzdGVuemEsIGNvbnRhdHRhIHN1cHBvcnQuZ29nLmNvbS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbENvbGxlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0IChjKSBieSBQLkouIFBsYXVnZXIsIGxpY2Vuc2VkIGJ5IERpbmt1bXdhcmUsIEx0ZC4gQUxMIFJJR0hUUyBSRVNFUlZFRC4=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29SZWdpc3Rlck1lc3NhZ2VGaWx0ZXI=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y29zdGEgcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q291bGQgbm90IHdyaXRlIGljb24gZGF0YSB0byBmaWxlIFt7fV0=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q291bGRuJ3Qgd3JpdGUgdG8gZmlsZSBbe31dLiBFcnJvciBjb2RlIHt9Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q291bnQ2NEY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZUJpdG1hcA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZURD","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRElCU2VjdGlvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZSBmYWlsZWQgd2l0aCBlcnJvciB7fQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU29saWRCcnVzaA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGltZXJRdWV1ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGltZXJRdWV1ZVRpbWVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRpbmcgZGlyZWN0b3J5IFt7fV0gZmFpbGVkLiBFcnJvciBjb2RlIHt9Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Jvc29mdFxXaW5kb3dzIE5UXEN1cnJlbnRWZXJzaW9u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Jvc3MgZGV2aWNlIGxpbms=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRuZXRQcmVGZXRjaFRyaWdnZXJQZXJpb2RTZWNvbmRz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y1NfTVJIcixn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q1NEVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Rpb25zLWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3VsdHVyZUluZm8=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3VzdG9tVGFiQ29udHJvbA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$63","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Z0R0NAX1dE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3cgfDpDJmg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCw8VVwkJzk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZC5iYXNlNjQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZC5NYXJnaW4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZC5OYW1l","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJnSklURGVidWdMYXVuY2hTZXR0aW5n","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGJnTWFuYWdlZERlYnVnZ2Vy","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGRkZCwgTU1NTSBkZCwgeXl5eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnYWJsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXJCcm93c2FibGVBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXJCcm93c2FibGVTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnZXJOb25Vc2VyQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdnaW5nTW9kZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVidWdUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlZCB0b2tlbjogW3t9XQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUGF5bG9hZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVjcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdENvbm5lY3Rpb25TZXR0aW5ncw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGVmYXVsdEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFJlZ2lzdHJhdGlvblJlZnJlc2hJbnRlcnZhbA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFJlZ2lzdHJhdGlvblRUTA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFNlY3VyZVByb3RvY29scw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU2VjdXJpdHlDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU2V0dXBGaWxl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlVGltZXJRdWV1ZVRpbWVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVudGUgb3UgYXR0ZW5kcmUgcXUnZWxsZSBzZSB0ZXJtaW5lLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVudGlmaWNhdGlvbiI6ICI=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzZXJpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGV2aWNlIG9yIHJlc291cmNlIGJ1c3k=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGV2T3ZlcnJpZGVFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGhjcGNzdmM2","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcERvbWFpbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcE5hbWVTZXJ2ZXI=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcE5vZGVUeXBl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcFJBQ29leGlzdGVuY2VFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcFNjb3BlSWQ=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcHY2RG9tYWlu","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGh1XlB7O1Vgbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ01hdGNoQW55TWFzaw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nUmVzdWx0","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlnaUNlcnQgSW5jMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlnaUNlcnQgVHJ1c3RlZCBSb290IEc0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlnaUNlcnQsIEluYy4xOzA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlnaUNlcnQsIEluYy4xQTA/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlnbyBkZSBlcnJvOiB7fS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGlnbyBkZSBlcnJvcjoge30u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGluZyBlcnJvciBmYWlsZWQgKFN0cmVhbVdyaXRlcik=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGluZyBpY29uIGZpbGU6","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0QWNjZXNzUHJlZmVyTG9jYWw=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0QWNjZXNzUXVlcnlPcmRlcg==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5IG5vdCBlbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5IG5vdCBlbXB0eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5Tm90Rm91bmRFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUFkYXB0ZXJEb21haW5OYW1l","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9GbHVzaFByb2Nlc3NOYW1lTGlzdA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9Qcm94eUF1dGg=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJyYW5jaENhY2hl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNBTmFtZUNvbnN0cmFpbnRz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNvYWxlc2Npbmc=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNvbmZpZ0NhY2hl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUR5bmFtaWNVcGRhdGU=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUlkbkVuY29kaW5n","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1hbmRhdG9yeUJhc2ljQ29uc3RyYWludHM=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1TSVBlZWs=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVBhcmFsbGVsQWFuZEFBQUE=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJldmVyc2VBZGRyZXNzUmVnaXN0cmF0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlcnZlclVucmVhY2hhYmlsaXR5","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNtYXJ0TmFtZVJlc29sdXRpb24=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNtYXJ0UHJvdG9jb2xSZW9yZGVyaW5n","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVuc3VwcG9ydGVkQ3JpdGljYWxFeHRlbnNpb25z","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVdhbkR5bmFtaWNVcGRhdGU=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRTeW5jRGVsdGFUaW1l","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGlzY2FyZGVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlQQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlVw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcG9zaW5n","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REpVU1RSRUNUa3BsN1tiIw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZE1ic19HV0VOVF9DTg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG5zUXVlcnlUaW1lb3V0cw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zUXVpY2tRdWVyeVRpbWVvdXRz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zU2VjdXJlTmFtZVF1ZXJ5RmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9FdmVudHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluTmFtZURldm9sdXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG9taW5pY2FuIHJlcHVibGlj","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFNob3dTdXBlckhpZGRlbg==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG93TmFtZV9HV0VOVF9DTg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmNhc2VTcG5DYXVzZUFwaU93bmVySXNUb29MYXp5","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWQgc3RpbGwgaW4gcHJvZ3Jlc3MuIEFyZSB5b3Ugc3VyZSB5b3Ugd2FudCB0byBxdWl0Pw==","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWQuVGFiSW5kZXg=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZG93bmxvYWRfY2FuY2VsbGVk","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRDYWNoZVF1b3RhSW5LQg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRlZCBsYXRlc3QgcmVtb3RlLWNvbmZpZyBmaWxlLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRGaWxlQXN5bmM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRpbmcgR09HIEdhbGF4eSAtIDAgTUIgb2YgMCBNQg==","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG93bmxvYWRMaW5rIjogIg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRQcm9ncmVzc0NoYW5nZWRFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRQcm9ncmVzc0NoYW5nZWRFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRTdGF0aXN0aWNz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9Xb3JrRXZlbnRBcmdz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9Xb3JrRXZlbnRIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVJbmZv","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVlIHRvIGZhaWx1cmUgaW4gZ2V0dGluZyBhbGxvd2VkIHZlcnNpb24gZnJvbSByZW1vdGUgY29uZmlnLCBzZXR0aW5nIGFsbG93ZWQgR2FsYXh5IHZlcnNpb24gdG8gMC4wLjAu","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZHVtcCBkZWNvZGVkIHRva2VuIHRvIHBheWxvYWQgZmlsZS4gQ29udGludWluZyB3aXRoIGluc3RhbGxhdGlvbi4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHVtcGluZyB0cmFuc2xhdGlvbiBmaWxlIG9mIGxhbmd1YWdlIFt7fV0sIHBhdGggW3t9XQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHVtcGluZyB0cmFuc2xhdGlvbiBmaWxlcy4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHluYW1pY1Byb2dyZXNzRmVlZGJhY2s=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHluYW1pY1NlcnZlclF1ZXJ5T3JkZXI=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZSBbe31dIGRvZXMgbm90IG1hdGNoIGV4cGVjdGVkIHNpemUuIFdyaXR0ZW4gW3t9XSwgZXhwZWN0ZWQgW3t9XQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZSBkZW4gYW5kZXJlbiBJbnN0YWxsYXRpb25zdm9yZ2FuZyBvZGVyIHdhcnRlLCBiaXMgZXIgYWJnZXNjaGxvc3NlbiBpc3Qu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZSBzZXQgdG8gemg=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RSJ2YVtEVGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZS5Mb2NhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZS5NYXJnaW4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTEzYzBkMjMtY2NiYy00ZTEyLTkzMWItZDljYzJlZWUyN2U0","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWF0ZSBmaWxlIG1hcHBpbmcgZm9yIGZpbGUgW3t9XS4gRXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWN0ZWQgRXJyb3I=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWN0aW9uX2xpbms=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWN0aW9uX3VybA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWQgdG8gbG9hZCByZXNvdXJjZS4gUmVzb3VyY2UgaWQ6IHt9Lg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWQgdG8gcGFyc2UgcGF5bG9hZCBkYXRhLCBlcnJvciBbe31dLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWRCc19HV0VOVF9DTg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQnJvd3NhYmxlU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWVkTWJzX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWYtK1h4UHA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZUh2Xj9wX0Fi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWplY3V0YW5kbw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWwgaW5zdGFsYWRvciB3ZWIgZGUgR09HIEdhbGF4eSByZXF1aWVyZSAuTkVUIEZyYW1ld29yayBwYXJhIGNvbnRpbnVhci4gVmlzaXRhIHN1cHBvcnQuZ29nLmNvbSBwYXJhIHJlY2liaXIgYXl1ZGEu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50QXJncw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWxhcHNlZEV2ZW50SGFuZGxlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWxFcnJvci5UZXh0QWxpZ24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWxXYWl0RW5k","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWxXZWxjb21lX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$64","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZU1pbnV0ZXNfR1dFTlRfQ04=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQWRhcHRlckRvbWFpbk5hbWVSZWdpc3RyYXRpb24=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b0ZpbGVUcmFjaW5n","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQ29uc29sZVRyYWNpbmc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlREFGb3JBbGxOZXR3b3Jrcw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRGVmYXVsdEh0dHAy","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRGhjcA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRG5z","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRmlsZVRyYWNpbmc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSWRuTWFwcGluZw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTG9n","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTWVudUl0ZW0=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTXVsdGljYXN0","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTXVsdGlIb21lZFJvdXRlQ29uZmxpY3Rz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHJveHk=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3RyaWN0Q2hlY2tzRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVGxzRXh0ZXJuYWxBbGdvcml0aG1z","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVmlzdWFsU3R5bGVz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2Vha1NpZ25hdHVyZUZsYWdz","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2luZG93","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlQmFzZTY0","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5jcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5kIG9mIGlucHV0","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5kLlRhYkluZGV4","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5kX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZW5kaW5nIGVycm9yIHRvIGdhbGF4eS1jbGllbnQtcmVwb3J0cy5nb2cuY29tOg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1iZWxpemU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYXJpYmJlYW4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1zb3V0aCBhZnJpY2E=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZW50X3ZlcnNpb249","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlNb25pdG9ycw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYXRlU2VjdXJpdHlQYWNrYWdlc1c=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNFeA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRocmVhZFdpbmRvd3M=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW52aXJvbm1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXIgbGUgc3VwcG9ydC5nb2cuY29t","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXJyZXVyIGQnaW5zdGFsbGF0aW9u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3IuTWFyZ2lu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JDb25uZWN0aW9uX0dXRU5UX0NOYw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxd","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxe","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxfR1dFTlRfQ04=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxfbGluaw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxfdXJs","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxh","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxj","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxJ","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxs","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWxV","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWx2","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JEb3dubG9hZEZhaWx5","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3JlIGRpIGluc3RhbGxhemlvbmU=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JlIGR1cmFudGUgbCdpbnN0YWxsYXppb25lIGRpIEdPRyBHYWxheHkuIFJpcHJvdmEsIG8gY29udGF0dGEgc3VwcG9ydC5nb2cuY29tLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JPdXRkYXRlZA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JPdXRkYXRlZF91cmw=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JSZXBvcnRTZW50","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JVbmV4cGVjdGVk","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JVbmV4cGVjdGVkX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JVbmV4cGVjdGVkX3VybA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNlLWhvbmdrb25n","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNmaGFuIDQgYg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXNzQmFyRG93bmxvYWQuTG9jYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNzU2l6ZS5UZXh0","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNzU2l6ZS5aT3JkZXI=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNzU3RhdHMuSW1lTW9kZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXNzU3RhdHMuTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXN0IG9mIGZpbGUu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVQgRnJhbWV3b3JrLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVVua25vd24gZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXZlbnRfdHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRIYW5kbGVyYDE=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRIYW5kbGVyRXh0ZW5zaW9ucw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXZlbnRPYmplY3Q=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhlYyBmb3JtYXQgZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXhlY3V0YWJsZSBmb3JtYXQgZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0aW5nIGluc3RhbGxlciBhdCBwYXRoIFt7fV0gZmFpbGVkLiBFcnJvciBjb2RlIDEpIHt9IDIpIHt9Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0aW5nIGluc3RhbGxlci4gUGF0aCBbe31dLCBwYXJhbXMgW3t9XS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdEFwcGxpY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdGluZyBhcHBsaWNhdGlvbiB3aXRoIHJldHVybiBjb2Rl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXhpdE1zZ1F1ZXN0aW9uX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXhpdE1zZ1RpdGxl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRWYXJpYWJsZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5zaW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXh0cmFjdGluZyBpY29uIHJlc291cmNlcy4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$65","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ri0xNkxFVU5JQ09ERQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGF0IHJlYWRpbmcgdG9rZW4u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGdldHRpbmcgZmlsZSBzaXplIGZyb20gZmQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGdldHRpbmcgZmlsZSBzaXplLiBmZCBpcyBudWxs","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIGdldHRpbmcgdGltZXpvbmUgaW5mby4=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIG9wZW5pbmcgZmlsZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHJlIG9wZW5pbmcgZmlsZSAtIHdhcyBub3Qgb3BlbmVkIGJlZm9yZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGNvcHkgbG9jYWwgcmVtb3RlLWNvbmZpZyBvdmVycmlkZSBmcm9tIHBhdGgge30gdG8gcGF0aCB7fS4gRXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGNyZWF0ZSBmaWxlIFt7fV0uIEVycm9yIGNvZGUge30u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGNyZWF0ZSBmaWxlIG1hcHBpbmcgZm9yIGZpbGUgW3t9XS4gRXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGNyZWF0ZSBpY29uIGZpbGUgaW4gcGF0aCBbe31dLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGRlY29kZSBiYXNlNjQgdG9rZW4uIENvbnRpbnVpbmcgd2l0aCBpbnN0YWxsYXRpb24u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGRvd25sb2FkIHJlbW90ZS1jb25maWcgdG8gZmlsZSBkdWUgdG8gZXJyb3IgRV9PVVRPRk1FTU9SWS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGRvd25sb2FkIHJlbW90ZS1jb25maWcgdG8gZmlsZSBkdWUgdG8gZXJyb3IgSU5FVF9FX0RPV05MT0FEX0ZBSUxVUkUu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGRvd25sb2FkIHJlbW90ZS1jb25maWcgdG8gZmlsZSBkdWUgdG8gdW5rbm93biBlcnJvci4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGR1bXAgZGVjb2RlZCB0b2tlbiB0byBwYXlsb2FkIGZpbGUuIENvbnRpbnVpbmcgd2l0aCBpbnN0YWxsYXRpb24u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGR1bXAgdG9rZW4gdG8gcGF5bG9hZCBmaWxlLiBDb250aW51aW5nIHdpdGggaW5zdGFsbGF0aW9uLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGZpbmQgcmVzb3VyY2UuIFJlc291cmNlIGlkOiB7fS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGdldCBjYW1wYWlnbiBmcm9tIGpzb24sIGVycm9yIFt7fV0u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGdldCByZWdpc3RyeSBpbmZvIGF0IFt7fV0sIGJ1dCBmb3VuZCBpbmZvIGF0IFt7fV0uIEFzc3VtaW5nIHRoYXQgc3lzdGVtIGlzIDMyIGJpdC4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIGxvYWQgcmVzb3VyY2UuIFJlc291cmNlIGlkOiB7fS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG1hcCB2aWV3IG9mIGZpbGUgZm9yIGZpbGUgW3t9XS4gRXJyb3IgY29kZSB7fS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG9wZW4gcmVnaXN0cnkga2V5IFt7fV0uIEVycm9yIGNvZGUge30u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIG9wZW4gcmVtb3RlIGNvbmZpZyBmaWxlIFt7fV0sIGVycm9yIFt7fV0uIEluc3RhbGxhdGlvbiBzaG91bGQgcHJvY2VzcyBhcyBub3JtYWwu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHBhcnNlIGJhc2U2NCB0b2tlbiwgZXJyb3IgW3t9XQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHBhcnNlIHBheWxvYWQgZGF0YSwgZXJyb3IgW3t9XS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHF1ZXJ5IHJlZ2lzdHJ5IGtleSBbe31dLiBFcnJvciBjb2RlIHt9Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHJlYWQgZnJvbSByZW1vdGUgY29uZmlnIGZpbGUgW3t9XSwgZXJyb3IgW3t9XS4gSW5zdGFsbGF0aW9uIHNob3VsZCBwcm9jZWVkIGFzIG5vcm1hbC4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHJlbW92ZSB0ZW1wb3JhcnkgZm9sZGVyIFt7fV0uIEVycm9yIGNvZGU6IHt9","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHNldCBmaWxlIHBvaW50ZXIsIGVycm9yIHt9","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHVubWFwIHZpZXcgb2YgZmlsZSBbe31dLiBFcnJvciBjb2RlIHt9Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHRvIHdyaXRlIElDTyBoZWFkZXIu","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmFpbGVkIHdyaXRpbmcgdG8gZmlsZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmFsc2UgbGl0ZXJhbA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZVNJTUQ=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmVobGVyIGJlaSBkZXIgSW5zdGFsbGF0aW9u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmlnIHN1Z2dlc3RzIHRoaXMgaW5zdGFsbGVyIGlzIGRlcHJlY2F0ZWQu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSBbe31d","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSBleGlzdHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBleGlzdHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFjY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURpcmVjdG9yeQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlTWlsbGlzZWNvbmRzQmV0d2VlblJldHJpZXM=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUluVXNlUmV0cnlBdHRlbXB0cw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZUxvZ2dlcg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZW5hbWUgdG9vIGxvbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZW5hbWUgdG9vIGxvbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZU5vdEZvdW5kRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVNoYXJl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN5c3RlbUluZm8=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRyYWNpbmdNYXNr","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsdGVyQ2x1c3Rlcklw","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsdGVyVlBOVHJpZ2dlcg==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlQQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFJlc291cmNlVw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlyc3RFbnRyeQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzQWxsb2M=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmxzRnJlZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVmFsdWVGbGFncw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm9yIHdyaXRpbmc=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Zm9ybWF0IHNwZWNpZmllciAne30nIHJlcXVpcmVzIG51bWVyaWMgYXJndW1lbnQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Zm9ybWF0IHNwZWNpZmllciAne30nIHJlcXVpcmVzIHNpZ25lZCBhcmd1bWVudA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybUNsb3NpbmdFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybVdpbmRvd1N0YXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWV3b3Jr","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnRleHRCdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNyZWRlbnRpYWxzSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlBbmRFeGl0VGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJhc2U2NFN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVNlY29uZHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnR3YXJlXEdPRy5jb21cR2FsYXh5Q2xpZW50XHBhdGhz","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnVuY3Rpb24gbm90IGltcGxlbWVudGVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnVuY3Rpb24gbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyBhcmd1bWVudHM6","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyBzdWNjZXNzZnVs","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RyhQMzJaTWJd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZykoW3xYPkgx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zy5jb20=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZzYuQVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FkdmFwaTMy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IGRvZXMgbm90IGV4aXN0IC0gR2FsYXh5Q2xpZW50LmV4ZSBub3QgZm91bmQgZGVzcGl0ZSByZWdpc3RyeSBpbmZvcm1hdGlvbiBhdCBbe31dLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IGRvZXMgbm90IGV4aXN0LiBGYWlsZWQgdG8gZ2V0IHJlZ2lzdHJ5IGluZm8gYXQgW3t9XSBhbmQgW3t9XS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IGRvZXMgbm90IGV4aXN0LiBGYWlsZWQgdG8gZ2V0IHJlZ2lzdHJ5IGluZm8gYXQge30u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IGRvZXMgbm90IGV4aXN0LiBTaHV0dGluZyBkb3du","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2FsYXh5IGV4aXN0ZW5jZS4=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IGV4aXN0cyAtIEdhbGF4eUNsaWVudC5leGUgZm91bmQgYXQgW3t9XS4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IHJlcXVpZXJlIC5ORVQgRnJhbWV3b3JrIHBhcmEgY29udGludWFyLiBWaXNpdGEgc3VwcG9ydC5nb2cuY29tIHBhcmEgcmVjaWJpciBheXVkYS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5IFdlYmluc3RhbGxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2FsYXh5LWNsaWVudC1yZXBvcnRzLmdvZy5jb20vcHJvYmxlbS5waHA=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2FsYXh5X2Rvd25sb2FkX2NvbXBsZXRlZA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5SW5zdGFsbGVy","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5SW5zdGFsbGVyXw==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkFwcC5jb25maWc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLmVzLU1YLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLmVzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLmtvLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLnBsLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLnB0LUJSLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLnpoLUhhbnQucmVzb3VyY2Vz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLkxvY2FsaXphdGlvbi5TdHJpbmdzLnpoLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLlByb3BlcnRpZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLlByb3BlcnRpZXMuUmVzb3VyY2VzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLnJlc291cmNlcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FsYXh5V2ViSW5zdGFsbGVyLldpbmRvdy5yZXNvdXJjZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2FsVHJhZGVtYXJrcw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZXJpY2Fu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2RpcENvbWJpbmVSZWdpb25SZWdpb24=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcENyZWF0ZUhhbGZ0b25lUGFsZXR0ZQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcENyZWF0ZU1hdHJpeA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcENyZWF0ZVJlZ2lvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcERlbGV0ZU1hdHJpeA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcERlbGV0ZVJlZ2lvbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldENsaXA=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldERD","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldE1hdHJpeEVsZW1lbnRz","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldFJlZ2lvbkhSZ24=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldFRleHRSZW5kZXJpbmdIaW50","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcEdldFdvcmxkVHJhbnNmb3Jt","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcElzSW5maW5pdGVSZWdpb24=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcElzTWF0cml4SWRlbnRpdHk=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcFJlbGVhc2VEQw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcFJlc3RvcmVHcmFwaGljcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcFNhdmVHcmFwaGljcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcFNldENsaXBSZWN0SQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpcFRyYW5zbGF0ZVdvcmxkVHJhbnNmb3Jt","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGVkQ29kZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWF1c3RyaWFu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R0VUIC9jb21wb25lbnRzL3dlYmluc3RhbGxlcj9jb21wb25lbnRfdmVyc2lvbj0yLjAuMCBIVFRQLzEuMUFjY2VwdDogKi8qQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlVXNlci1BZ2VudDogTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDEwLjA7IFdPVzY0OyBUcmlkZW50LzcuMDsgLk5FVDQuMEM7IC5ORVQ0LjBFOyBJbmZvUGF0aC4zOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuMC4zMDcyOTsgLk5FVCBDTFIgMy41LjMwNzI5KUhvc3Q6IHJlbW90ZS1jb25maWcuZ29nLmNvbUNvbm5lY3Rpb246IEtlZXAtQWxpdmU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"R0VUIC9vcGVuX2xpbmsvZG93bmxvYWQ/cGF0aD0vb3Blbi9nYWxheHkvY2xpZW50L3NldHVwX2dhbGF4eV8yLjAuOTAuMjMuZXhlIEhUVFAvMS4xSG9zdDogY29udGVudC1zeXN0ZW0uZ29nLmNvbUNvbm5lY3Rpb246IEtlZXAtQWxpdmU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0FTQ0lJ","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Fzc2VtYmx5","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0F2YWlsYWJsZUZyZWVTcGFjZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Jhc2Vz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2J1dHRvbkRvd25sb2FkQWJvcnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2J1dHRvbkRvd25sb2FkQWJvcnRfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2J1dHRvbkVycm9yRXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2J1dHRvbkVycm9yRXhpdF9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0J5dGVzUmVjZWl2ZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NhbmNlbGxhdGlvblBlbmRpbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NhbmNlbGxlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NoYXJz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Nsb3NlUmVhc29u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2NvbnRlbnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvbnRyb2w=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0NvbnRyb2xz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnRUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0N1cnJlbnRVSUN1bHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0RlZmF1bHQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2RlcHJlY2F0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Rlc2lnbk1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Rvd25sb2FkTGluaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0VsYXBzZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0VuYWJsZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Vycm9y","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yQ29ubmVjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yQ29ubmVjdGlvbl9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yQ29ubmVjdGlvbl9saW5r","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yQ29ubmVjdGlvbl91cmw=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yRG93bmxvYWRGYWls","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yRG93bmxvYWRGYWlsX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yRG93bmxvYWRGYWlsX2xpbms=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yRG93bmxvYWRGYWlsX3VybA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yT3V0ZGF0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yT3V0ZGF0ZWRfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yT3V0ZGF0ZWRfbGluaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yT3V0ZGF0ZWRfdXJs","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yU3BhY2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yU3BhY2VfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yVW5leHBlY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yVW5leHBlY3RlZF9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yVW5leHBlY3RlZF9saW5r","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2Vycm9yVW5leHBlY3RlZF91cmw=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0V4aXRDb2Rl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2V4aXRNc2dRdWVzdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2V4aXRNc2dRdWVzdGlvbl9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2V4aXRNc2dUaXRsZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2V4aXRNc2dUaXRsZV9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0Z1bGxOYW1l","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2dvZ0dhbGF4eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2dvZ0dhbGF4eV9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0hvdXJz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2luc3RhbGxlck1kNQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0ludm9rZVJlcXVpcmVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzQnVzeQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzSGFuZGxlQ3JlYXRlZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0lzUmVhZHk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsRG93bmxvYWRTaXpl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsRG93bmxvYWRTaXplX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsV2FpdEVuZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsV2FpdEVuZF9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsV2VsY29tZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2xhYmVsV2VsY29tZV9HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X0xlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01haW5Nb2R1bGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01lc3NhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X01pbnV0ZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X25hbWVfc3BhY2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X05ld0xpbmU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2R1Y3RWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Byb2dyZXNzUGVyY2VudGFnZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Jlc291cmNlTWFuYWdlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1Jlc3VsdA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlY29uZHM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1NlbGVjdGVkVGFi","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NlcnZlcl9hZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NpemVfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkQnM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkQnNfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkS2Jz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkS2JzX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkTWJz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3NwZWVkTWJzX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXJ0dXBQYXRo","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1N0YXR1c0NvZGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVIb3Vycw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVIb3Vyc19HV0VOVF9DTg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVNaW51dGVz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVNaW51dGVzX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVTZWNvbmRz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3RpbWVTZWNvbmRzX0dXRU5UX0NO","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsQnl0ZXNUb1JlY2VpdmU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsRnJlZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1RvdGFsU2Vjb25kcw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VzZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1VURjg=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3ZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3dlYmluc3RhbGxlckV2ZW50","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1dpZHRo","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3dpbmRvd05hbWU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3dpbmRvd05hbWVfR1dFTlRfQ04=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3dpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QUNQ","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRhcHRlcnNBZGRyZXNzZXM=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRkckluZm9X","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0QmtNb2Rl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FtcGFpZ24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZv","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZvVw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcFJnbg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVB","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlckV4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEV4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVmYXVsdFRhcmdldERyaXZlRnJlZVNwYWNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCaXRz","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyZWN0b3J5TmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGxnSXRlbQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUNvbnRlbnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9jdXM=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9sZGVyUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFuZ3VhZ2VBcmd1bWVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0TG9jYWxpemF0aW9uU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbFByb2Nlc3NvckluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbFByb2Nlc3NvckluZm9ybWF0aW9uRXg=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9nUGF0aA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0TUQ1T2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZUE=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmVhcmVzdENvbG9y","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmV0d29ya1BhcmFtcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TnVtYUhpZ2hlc3ROb2RlTnVtYmVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0VHlwZQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGF0aFJvb3Q=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0FmZmluaXR5TWFzaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVtb3RlQ29uZmlnSnNvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVxdWVzdFN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2U=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVzcG9uc2VTdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2l6ZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3BlZWRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm8=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWVudQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dEFsaWdu","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dENvbG9y","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkR3JvdXBBZmZpbml0eQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJpb3JpdHk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdEV4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVRvRmluaXNoU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0dGluZyB0ZW1wb3JhcnkgcGF0aCBmYWlsZWQuIEVycm9yIGNvZGUge30u","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHJhY2VFbmFibGVGbGFncw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHJhY2VFbmFibGVMZXZlbA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHJhY2VMb2dnZXJIYW5kbGU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VHlwZUZyb21IYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRVSUxhbmd1YWdl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uQQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R0hJSktMTU5P","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HICBzcC4geiBvLm8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HICBzcC4geiBvLm8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSAtIEdhbWUgSW5zdGFsbGVy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSAtIFdlYiBJbnN0YWxsZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSByZXF1aXJlcyBXaW5kb3dzIDcgU1AxIG9yIG5ld2VyLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWIgSW5zdGFsbGVy","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWIgSW5zdGFsbGVyIGZhaWxlZCB0byBpbml0aWFsaXplLiBDb250YWN0IHN1cHBvcnQuZ29nLmNvbSBmb3IgYXNzaXN0YW5jZS4gRXJyb3IgY29kZToge30u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWIgSW5zdGFsbGVyIHJlcXVpcmVzIC5ORVQgRnJhbWV3b3JrIHRvIHByb2NlZWQuIENvbnRhY3Qgc3VwcG9ydC5nb2cuY29tIGZvciBhc3Npc3RhbmNlLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWIgSW5zdGFsbGVyIHJpY2hpZWRlIC5ORVQgRnJhbWV3b3JrIHBlciBjb250aW51YXJlLiBQZXIgcmljZXZlcmUgYXNzaXN0ZW56YSwgY29udGF0dGEgc3VwcG9ydC5nb2cuY29tLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWJpbnN0YWxsZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSBXZWJpbnN0YWxsZXIuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HIEdhbGF4eSB3eW1hZ2Egc3lzdGVtdSBXaW5kb3dzIDcgU1AxIGx1YiBub3dzemVnby4=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HIFNwLiB6IG8uby4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R09HLVdFQklOU1RBTExFUk1VVEVY","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HLmNvbSBTcC4geiBvLm8u","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HLmNvbVxHYWxheHlcbG9nc1w=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z29nR2FsYXh5","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z29nR2FsYXh5X0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R09HV2ViaW5zdGFsbGVyLzIuMC43Mzc2LjI4NTI5IChNaWNyb3NvZnQgV2luZG93cyAxMCBQcm8p","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z1F1ZXN0aW9u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z3JhbW1lIGQnaW5zdGFsbGF0aW9uIGRlIEdPRyBHYWxheHkuIENvbnRhY3RleiBsZSBzdXBwb3J0LmdvZy5jb20gcG91ciBvYnRlbmlyIHVuZSBhc3Npc3RhbmNlLiBDb2RlIGRlIGwnZXJyZXVyIDoge30u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z3Jlc3NCYXJEb3dubG9hZC5TaXpl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z3Jlc3NTaXplLkxvY2F0aW9u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z3Jlc3NTaXplLlR5cGU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z3JvdW5kLkxvY2F0aW9u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R3JvdXBBZmYq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z3VpIGVsZW1lbnRzLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R3VpZHNEWnIr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"R3VpVXBkYXRl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SChCSmolWGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aFxuYUAsLk4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGFwaS1tcy13aW4tYXBwbW9kZWwtcnVudGltZS1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGFyZHdhcmVJRA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFzIHRva2VuLiBUcnkgdG8gcmVhZCBpdA==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGFzaEFsZ29yaXRobQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNpemU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGVyXGxvZ3Nc","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlsbENsaW1iaW5nX1RhcmdldFNpZ25hbFRvTm9pc2VSYXRpbw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SEtMTV9HZXRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aG9uZy1rb25n","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aG9zdCB1bnJlYWNoYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHRzLWNvbGxlY3Rvci5nb2cuY29t","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMTAwIENvbnRpbnVl","type":"Ansi","source":"Decrypted SSL Data","process":null,"filename":"SSL","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LQ29ubmVjdGlvbjoga2VlcC1hbGl2ZUNvbnRlbnQtTGVuZ3RoOiAyNzlTZXJ2ZXI6IG5naW54Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uRXhwaXJlczogTW9uLCAwMyBOb3YgMjAyNSAyMzoyNDo1OSBHTVRDb250ZW50LUVuY29kaW5nOiBnemlwVmlhOiAxLjEgdmFybmlzaCwgMS4xIHZhcm5pc2hjYWNoZS1jb250cm9sOiBtYXgtYWdlPTEyMHgtb3JpZ2luLWFnZTogMHgtZGF0ZTogTW9u","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjA0IE5vIENvbnRlbnRDb25uZWN0aW9uOiBrZWVwLWFsaXZlU2VydmVyOiBuZ2lueENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MCwgbm8tY2FjaGUsIG5vLXN0b3JlLCBwcml2YXRleC1vcmlnaW4tYWdlOiAwQWNjZXB0LVJhbmdlczogYnl0ZXNWaWE6IDEuMSB2YXJuaXNoLCAxLjEgdmFybmlzaERhdGU6IE1vbiwgMDMgTm92IDIwMjUgMjM6MjU6MDQgR01UWC1TZXJ2ZWQtQnk6IGNhY2hlLWZyYS1ldG91ODIyMDE1Mg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjA0IE5vIENvbnRlbnRDb25uZWN0aW9uOiBrZWVwLWFsaXZlU2VydmVyOiBuZ2lueENhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MCwgbm8tY2FjaGUsIG5vLXN0b3JlLCBwcml2YXRleC1vcmlnaW4tYWdlOiAwQWNjZXB0LVJhbmdlczogYnl0ZXNWaWE6IDEuMSB2YXJuaXNoLCAxLjEgdmFybmlzaERhdGU6IE1vbiwgMDMgTm92IDIwMjUgMjM6MjU6MDQgR01UWC1TZXJ2ZWQtQnk6IGNhY2hlLWZyYS1ldG91ODIyMDE1Mi1GUkEsIGNhY2hlLWxheC1rd2hwMTk0MDAzMy1MQVhYLUNhY2hlOiBNSVNTLCBNSVNTWC1DYWNoZS1IaXRzOiAwLCAw","type":"Ansi","source":"Decrypted SSL Data","process":null,"filename":"SSL","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMzAyIEZvdW5kQ29ubmVjdGlvbjoga2VlcC1hbGl2ZUNvbnRlbnQtTGVuZ3RoOiA1NDhTZXJ2ZXI6IG5naW54Q29udGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLThMb2NhdGlvbjogaHR0cHM6Ly9nb2ctY2RuLWZhc3RseS5nb2cuY29tL29wZW4vZ2FsYXh5L2NsaWVudC9zZXR1cF9nYWxheHlfMi4wLjkwLjIzLmV4ZVgtQ0FDSEUtQUROLVRUTDogMzYwMENhY2hlLUNvbnRyb2w6IHB1YmxpYywgbWF4LWFn","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMF0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9yZW1vdGUtY29uZmlnLmdvZy5jb20vY29tcG9uZW50cy93ZWJpbnN0YWxsZXI/Y29tcG9uZW50X3ZlcnNpb249Mi4wLjA=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFN0YXR1c0NvZGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFV0aWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlcXVlc3Q=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cFdlYlJlc3BvbnNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SFdSUG9ydFJldXNlT25Tb2NrZXRCaW5k","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SSshLmx8c2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aTIuPi9uIkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aTosOTN3KCsz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUI7Z0dzJm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWNodCBnZWZ1bmRlbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNvbiBkYXRhIHdyaXR0ZW4gdG8gZmlsZSBbe31dIGRvZXMgbm90IG1hdGNoIGV4cGVjdGVkIHNpemUu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUNvbnRhaW5lcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWQgbm90IGRyb3BwZWQgcmVtb3RlIGNvbmZpZywgdHJ5aW5nIHRvIGRvd25sb2Fk","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUREX0FCT1VUQk9Y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllciByZW1vdmVk","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3Bvc2FibGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWcgc291cmNlOg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWcgdG8gZmlsZSBkdWUgdG8gZXJyb3IgSU5FVF9FX0RPV05MT0FEX0ZBSUxVUkUu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWdpbmFsRmlsZW5hbWU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$66","type":"Ansi","source":"File String Dumps","process":null,"filename":"icon.ico","compromised":null,"detection_total":null,"total":null},{"value":"SUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWxsZWdhbCBieXRlIHNlcXVlbmNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWxsZWdhbCBieXRlIHNlcXVlbmNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW0uVXNlckQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW1lTWludXRlcw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW1wb3NzaWJpbGUgaW5pemlhbGl6emFyZSBHT0cgR2FsYXh5IFdlYiBJbnN0YWxsZXIuIENvbnRhdHRhIHN1cHBvcnQuZ29nLmNvbSBwZXIgcmljZXZlcmUgYXNzaXN0ZW56YS4gQ29kaWNlIGVycm9yZToge30u","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW1wb3NzaWJpbGUgdHJvdmFyZSAuTkVUIEZyYW1ld29yaw==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW1wcm9wZXIgbGluaw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW4gZXNlY3V6aW9uZS4gQ2hpdWRpIGwnaW5zdGFsbGF6aW9uZSBwcmVjZWRlbnRlIG8gYXR0ZW5kaSBjaGUgZmluaXNjYS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5hcHByb3ByaWF0ZSBJL08gY29udHJvbCBvcGVyYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5hcHByb3ByaWF0ZSBpbyBjb250cm9sIG9wZXJhdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wbGV0ZSBVVEYtOCBzdHJpbmc7IGxhc3QgYnl0ZTogMHg=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5kZXgzMjU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5kb3dOYW1l","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5pZGFkICYgdG9iYWdv","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdENvbW1vbkNvbnRyb2xzRXg=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbXBvbmVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNlY3VyaXR5Q29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6aW5nIGluc3RhbGxlciBib290c3RyYXBwZXIu","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5ueSBpbnN0YWxhdG9yIEdPRyBHYWxheHkganU=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wdXQvb3V0cHV0IGVycm9y","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5zaWdodHMtY29sbGVjdG9yLmdvZy5jb20=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsYXRvciBqdQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsYXRvciBzaWVjaW93eSBHT0cgR2FsYXh5IG5pZSB1cnVjaG9taQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsYXRvciBzaWVjaW93eSBHT0cgR2FsYXh5IHd5bWFnYSAuTkVUIEZyYW1ld29yaywgYWJ5IGtvbnR5bnVvd2E=","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uIEVycm9y","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uIEZhaWxlZA==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uIGZlaGxnZXNjaGxhZ2Vu","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF0aW9uVHlwZQ==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGF6aW9uZSBmYWxsaXRh","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGVyIEFscmVhZHkgUnVubmluZw==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGVyIGZhaWxlZCB0byBpbml0aWFsaXplLiBDb250YWN0IHN1cHBvcnQuZ29nLmNvbSBmb3IgYXNzaXN0YW5jZS4gRXJyb3IgY29kZToge30u","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdGFsbGVyLiBQYXRoIFt7fV0sIHBhcmFtcyBbe31dLg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGVyQm9vdHN0cmFwcGVy","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGVyQm9vdHN0cmFwcGVyLCBWZXJzaW9uIDIuMA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbGVyQm9vdHN0cmFwcGVyLmxvZw==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbFJvb3Q=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQb3BFbnRyeVNMaXN0","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQdXNoRW50cnlTTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW50ZXJydXB0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJydXB0ZWQgZnVuY3Rpb24gY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBhcmd1bWVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBhcmd1bWVudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmaWxsIGNoYXJhY3RlciAneyc=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmb3JtYXQgc3BlY2lmaWVyIGZvciBjaGFy","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBmb3JtYXQgc3RyaW5n","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBsaXRlcmFs","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBudW1iZXI7IGV4cGVjdGVkICcrJywgJy0nLCBvciBkaWdpdCBhZnRlciBleHBvbmVudA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBudW1iZXI7IGV4cGVjdGVkIGRpZ2l0IGFmdGVyICctJw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBudW1iZXI7IGV4cGVjdGVkIGRpZ2l0IGFmdGVyICcuJw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBudW1iZXI7IGV4cGVjdGVkIGRpZ2l0IGFmdGVyIGV4cG9uZW50IHNpZ24=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzZWVr","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBzZWVr","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6ICdcdScgbXVzdCBiZSBmb2xsb3dlZCBieSA0IGhleCBkaWdpdHM=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IGNvbnRyb2wgY2hhcmFjdGVyIG11c3QgYmUgZXNjYXBlZA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IGZvcmJpZGRlbiBjaGFyYWN0ZXIgYWZ0ZXIgYmFja3NsYXNo","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IGlsbC1mb3JtZWQgVVRGLTggYnl0ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IG1pc3NpbmcgY2xvc2luZyBxdW90ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IHN1cnJvZ2F0ZSBVK0RDMDAuLlUrREZGRiBtdXN0IGJlIGZvbGxvd2VkIGJ5IFUrREMwMC4uVStERkZG","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmc6IHN1cnJvZ2F0ZSBVK0RDMDAuLlUrREZGRiBtdXN0IGZvbGxvdyBVK0Q4MDAuLlUrREJGRg==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBVVEYtOCBieXRlIGF0IGluZGV4","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZGF0ZVJlY3Q=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU9FeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9uLWwxLTItMQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmJhZGJpdCBzZXQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmVvZmJpdCBzZXQ=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9zX2Jhc2U6OmZhaWxiaXQgc2V0","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9zdHJlYW0=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW9zdHJlYW0gc3RyZWFtIGVycm9y","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXBobHBhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXJpc2gtZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXMgYSBkaXJlY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXMgYSBkaXJlY3Rvcnk=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWFtZXJpY2Fu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWphbWFpY2E=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXBhbmFtYQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXB1ZXJ0byByaWNv","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNJbmZpbml0eQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNJblJvbGU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZENvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZU5hbWU=","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3c=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dVbmljb2Rl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXQuVGFiSW5kZXg=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXRNc2dUaXRsZV9HV0VOVF9DTg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aVVCbiw2JCU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVdpbjMyV2luZG93","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXhOPEZhS3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXplLlRhYkluZGV4","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SmF2YVNjcmlwdFNlcmlhbGl6ZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SmhKbnZeVTxCZVQ/Zw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkpTSGo0P3Bqfg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sk5pZSB1ZGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"SyQwQlBFQDk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sy4jJC4rYy4zSw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SzBiJEYuTm1w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VuIHRvIFt7fV0=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzItcGFja2FnZS1jdXJyZW50LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuRExM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"a0YyYk9mRS5HR2pj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2pvamloTk5uJ2c/Z2Zl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2xbIip2Tkw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"a1VSTC5BdXRvU2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TC5UZXh0QWxpZ24=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxEb3dubG9hZFNpemU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxEb3dubG9hZFNpemVfR1dFTlRfQ04=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxQcm9ncmVzc1NpemU=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxQcm9ncmVzc1NpemVF","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxQcm9ncmVzc1N0YXRz","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxQcm9ncmVzc1N0YXRzRw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxXZWxjb21l","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxXZWxjb21lLkltZU1vZGU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxXZWxjb21lLlRhYkluZGV4","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxXZWxjb21lLlRleHRBbGlnbg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFiZWxXZWxjb21lX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFzdEVudHJ5","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGF1bmNoaW5nOg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGF4eSByZXF1ZXIgbyBXaW5kb3dzIDcgU1AxIG91IG1haXMgcmVjZW50ZS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGF4eSBXZWJpbnN0YWxsZXIuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGQgcHJvY2VlZCBhcyBub3JtYWwu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bERvd25sb2FkU2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGUgZmFpbGVkIHdpdGggZXJyb3Ige30=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGUgZnJhbWV3b3JrZCAuTkVUIGVzdCBpbnRyb3V2YWJsZQ==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGUgbmFtPGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5UG9saWN5VGltZVN0YW1w","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5V1BBRFN1cHBvcnQ=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGVyQm9vdHN0cmFwcGVyLmxvZw==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bEVycm9yLkltZU1vZGU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bEVycm9yLlR5cGU=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGVzcyB0aGFuIDQgYnl0ZXMgZnJvbSB0b2tlbiBzaXplIHBsYWNlLg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGV2YXRpb24gZGVuaWVkLiBTZXR1cCB3aWxsIG5vdCBjb250aW51ZS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGllbnQgc2V0dXAgZmlsZS4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGluZSBjYW1wYWlnbiBvdmVycmlkZTo=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGluZSBwYXlsb2FkIG92ZXJyaWRlOg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlua0xhYmVs","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGlua0xhYmVsMV9MaW5rQ2xpY2tlZF8x","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlua0xhYmVsTGlua0NsaWNrZWRFdmVudEFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlua0xhYmVsTGlua0NsaWNrZWRFdmVudEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGlua1VSTC5QYXJlbnQ=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGlua1VSTC5TaXpl","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGlzdDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGxlciBpcyBhbHJlYWR5IHJ1bm5pbmcuIFBsZWFzZSBjbG9zZSB0aGUgcHJldmlvdXMgaW5zdGFsbGF0aW9uIG9yIHdhaXQgZm9yIGl0IHRvIGZpbmlzaC4=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvcg==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvclc=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEljb24=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFJlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxDb250ZXh0Q2FjaGVTaXpl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxNYWNoaW5l","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jayBhbHJlYWR5IHRha2Vu","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1Jlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nRmFpbHVyZXM=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bG9nZ2VyIHdpdGggbmFtZSAn","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9naW5Vcmw=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nUmVzb3VyY2VCaW5kcw==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nU2VjdXJpdHlQZXJtaXNzaW9ucw==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bG9pXCVZLSVvXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG9uZyB0aW1l","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va2luZyBmb3IgcmVtb3RlIGNvbmZpZyBpbmZvIGZvciBHYWxheHkgQ2xpZW50Lg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9va3MgbGlrZSBpbnN0YWxsYXRpb24gb2YgR09HIEdhbGF4eSAyLjAgc3VjY2VlZGVkLg==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bG9zZSBldmVudDogVXNlckNsb3Npbmc6W2Nob2ljZT17MH1d","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHQ6IFt7fV0sIHNvdXJjZSBwYXRoOiBbe31dLCB0YXJnZXQgcGF0aDogW3t9XQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHRzdCBkdSB1bnRlciBzdXBwb3J0LmdvZy5jb20vaGMvZGUu","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHRzdCBkdSB1bnRlciBzdXBwb3J0LmdvZy5jb20vaGMvZGUuIEZlaGxlcmNvZGU6IHt9Lg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHooRG8uIEc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"bSBTcC4geiBvLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TTxrai8wemRmdC5XWjNGSUZY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TV9xVUheREk2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUtleXNldA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlld09mRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwV2luZG93UG9pbnRz","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsQ291bnRJbkNlcnQ=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ2VydENvdW50","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FjaGVkU29ja2V0cw==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FjaGVTaXpl","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FjaGVUdGw=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29uY3VycmVuY3k=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4TmVnYXRpdmVDYWNoZVR0bA==","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4TnVtYmVyT2ZBZGRyZXNzZXNUb1JlZ2lzdGVy","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UG9saWN5RWxlbWVudEtleQ==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUFaT1dJRUNLSUUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWQgc0NVVEZSeTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUQ1RG9Ob3RNYXRjaA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"GalaxyInstaller.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWVIb3Vyc19HV0VOVF9DTg==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVNaW51dGVzX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVTZWNvbmRzX0dXRU5UX0NO","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVzc2FnZSBzaXpl","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveA==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveEJ1dHRvbnM=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kSW52b2tlcg==","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LldpbjMy","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUlLK1FwakNB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluQ29uY3VycmVuY3k=","type":"Ansi","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWlua2VybmVsXGNydHNcdWNydFxpbmNcY29yZWNydF9pbnRlcm5hbF9zdHJ0b3guaA==","type":"Unicode","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWluUnNhUHViS2V5Qml0TGVuZ3Ro","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWlzc2luZyAnfScgaW4gZm9ybWF0IHN0cmluZw==","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWlzc2luZyBwcmVjaXNpb24gc3BlY2lmaWVy","type":"Ansi","source":"Hybrid Analysis","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU0vZGQveXlT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"GOG_Galaxy_2.0.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU1NTSBkZCwgeXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU9ORVRBUlk=","type":"Unicode","source":"Memory/File Scan","process":"GOG_Galaxy_2.0.exe","filename":"00000000-00005040.00000003.293266.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvclJlZ2lzdHJ5","type":"Ansi","source":"Runtime Data","process":"GOG_Galaxy_2.0.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value