Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 07:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe
- Size 854KB
- Sample260506-hvb9dab161
- SHA256 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56
- MD5 f1ccda42b770fc3b8fb019bd446efbe0
- SHA1 5ba74adde311428ce58d0edff63b81909c91076b
- SHA512 26e4cfacff53c282ce19f371bcc176070cea6b4dbb011d7c2e0fe4ebdae753027a94fe6391d4c5188a73c98fcfa703e3cb7593c3264c46e924cb07bcafd8f6fa
- SSDEEP 12288:X2JylsKTPW4VyPE5anru9dbhlMnldHzgwChptx7FYqbvNxvM:X2Jyxi4VltUdlChptx7FYAS
- TLSH T12D156BA1F3D004F6E0B79B388C724512DD76BD650E35999F12E86A4E1F3B6D14A3CB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 3464 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmp 5924 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm 4904 GOG.exe 4968 GOG.exe 2868 GOG.sys - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm Set value (str) \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened (read-only) \??\B: 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\7-Zip\7z.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\GOG.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm File opened for modification C:\Windows\GOG.exe 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm File created C:\Windows\GOG.exe GOG.exe File created C:\Windows\GOG.sys GOG.exe File opened for modification C:\Windows\GOG.sys GOG.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOG.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4448 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe 4448 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe 5552 javaws.exe 5552 javaws.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4968 GOG.exe 4968 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe 4904 GOG.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4448 wrote to memory of 3464 4448 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe 80 PID 4448 wrote to memory of 5924 4448 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe 81 PID 3464 wrote to memory of 5552 3464 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmp 82 PID 5924 wrote to memory of 4904 5924 02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm 83 PID 4968 wrote to memory of 2868 4968 GOG.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe"C:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmpC:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmp2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files\Java\jre-1.8\bin\javaws.exeC:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmp3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5552
-
-
-
C:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mmC:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
-
C:\Windows\GOG.exeC:\Windows\GOG.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\GOG.sysC:\Windows\GOG.sys /zhj2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\02ef2fcc348de80caae49d257431b7bfee161d054742fc4a1f51dbfa8ed5aa56.tmp
- Size 465KB
- SHA256 56c6f6ab0813c7770d65b161c322d27cc9794d7b78f32e0fb16d9240ff556b81
- MD5 67570284dbfb36019c5d212b7702f4bd
- SHA1 4db7befbbdc404aa6f7f0a30696f4c45739ba01d
- SHA512 d8a60ab4a68f8ab8ee315042dfafd45de15d10cee92f349446235951b08dcc14f10668a3596ef8fe1d69bde8674d48067ecbad964a28e9d2e569ac5ceff5f95a
- SSDEEP 6144:FdbYQKQMTTJnXtHQCgwCPqNQHppdoc/VHD7Fhaqb8K3HNxvh:FdbhlMnldHzgwChptx7FYqbvNxvh
- TLSH T14AA43A90F3E414E8F0B79A35C9765512DAB67C5A1B31CA8F03A4661A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\GOG.exe
- Size 388KB
- SHA256 e4e8599602ae1aa3a71f0ec6458312801f48acdc575f108f1da9cce91a2f82ad
- MD5 002e1468b4003ba4e1a3dbe6a798a65c
- SHA1 533a8b075e28de19bf77dbf925bb1aab5b3d5251
- SHA512 92e8f94f5bd8b869b743a541c2cede29ad4953c1d001d2d02670fa72e995284dcf62305564c96c9da88cb68c5c5a5a7a12bc6fb36a5b60b9cb8a827e51e9e800
- SSDEEP 6144:KajdMJyFRe6azHqTG5WbWBF+WR4VyKh6B686H6y6W6L6/:X2JylsKTPW4VyPE5anru/
- TLSH T1D9847D76F6C188F7E0A61F7C5C6251A6AC60BB300C3D642A79E45F8F5A3E5D2161C3A3
- MD5 SHA1 SHA512 SSDEEP TLSH