Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
- Size 2.6MB
- Sample260522-w5aeesc14m
- SHA256 a7fe6f894e07400719308fa2bdcaadfecbd96e22706ae2e8c9e0c55236c3ab11
- MD5 21e683da416e1cb4b10800ba19eaa971
- SHA1 6045f75eeb9b575bd5c1d8b961f27940d5d4a697
- SHA512 f907c648de1ef249ad82355681ecf3e81e68ce604c4b7f3fb6bfa51ba391483760368faee5ad33fa4b0dc547e3590825097c0d753fe8f00488735c39ee7922f7
- SSDEEP 49152:5wMFu9Gz5TZ2tQtfWafTFr/k5B4iWcIUOY4zzoCFKGEDtT6TM:PFuQRZ2tQt3/WBp5qIeTM
- TLSH T183D59E2E7D45C036E56211B15A29CFA7E22DAD38076214CB6FE8793DD9306C26B37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2728 Setup.exe 2644 SophosSetup_Stage2.exe 5308 SophosACSenabledTest.exe - Drops file in Program Files directory 47 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl Setup.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SophosSetup_Stage2.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80\Blob = 19000000010000001000000016aee18d205d4e54b5aee9b3c1466a210300000001000000140000005eeed86fa37c675230642f55c84ddbf67cd33c801d0000000100000010000000cfa020613a558555d3c1ea201f6276da140000000100000014000000680193b1d24a40426994462c1c5a88a925b4474f090000000100000016000000301406082b0601050507030306082b0601050507030853000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007353b6d6c2d6da4247773f3f07d075decb5134212bead0928ef1f461152609410b00000001000000380000004400690067006900430065007200740020004300530020005200530041003400300039003600200052006f006f00740020004700350000000f000000010000003000000082ef60cde833832df196a3351df5b2b90029e31f679cec503aeea7ca8893db9d81d4e576a9f216dd0baec61cb02a1460200000000100000068050000308205643082034ca003020102021006cee131be6d55c807f7c0c7fb44e620300d06092a864886f70d01010c0500304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f74204735301e170d3231303131353030303030305a170d3436303131343233353935395a304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f7420473530820222300d06092a864886f70d01010105000382020f003082020a0282020100b6337380d8620370142c111c395e7cae7c83861dfe262f4c24ad8bea835fa9bc3d5bfc0b984c024730ece2feece8345b665ebf3bd72ca625ff8c59b3dfeada7c29d9465072081d6ed11b0add1fcd9989fa0f0f73c4e19c1d7532cd6f97da2a6a95b26cc909d0ea0b7b7d17064999efd6dee0c853d4aec677f186bb231cb8c0df59f78e7dd1ef82e6268b5a38b5ff75d5b2d94f09f3378850da11a48a1414d15304007df36a4418fe507032071ca89a0e3a1dc50a1f6e0b2669b73ca257702c86fa4c6e95a95843b9ac12d6ff3fedd743176b4cce9ec490abfffa10509aa39057d6e78c10ae9f161acf351d7fd776ed8a9c35a728b8a75d21fc3037ddde08194f15c6e7a6da90478ef794534c8e5302befd99e5ea86d0af0302d39baa93f1ab288e2001ff4cfbccb72940f587a41213051f436ed751509f38b420ed1709128fccb919af9fcdbe6911d3af55106d1786799652c6b2009de5af38b035f4886b8f0e043d7ceeafcdd36a104ac6cd86ca223da14a5cfb0eff88df5c62a7c0b91ed9ac6c7e3837fe779325c2858a4fb537065a068114f1ce949d9991ea325ace673d6e0466ad0c4f2da32ef79ef5789df70afd7e8fe3428a5596bcf19f372dfc9e5f95fe8c181bfc8efd4b90afd703681263ace293a7a2cb04e54f64ce03fac6149fd98be8ccd4628c6be4002c199f1a06c6318154fb53249aaf5599ba9d75aeb8c2dd0203010001a3423040301d0603551d0e04160414680193b1d24a40426994462c1c5a88a925b4474f300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c0500038202010092fceeb802791702517d21c54967a7a4f1a82438eb0c68ea5a426b9cf473c1694a2db33705504298929e06792c2e0699f6efdf2ba0cdb3920183b5a0cb27b53c231a9849a2ec2d99a55943acd2b193d657d71cbc93d6c640e1b36f1955b713d7e54333a4b5abcbdac131640d74d62cedc38d6eebbbaf194761612dc0f405b96f78dc3af74240655391bd990d939254a6a937592b9bcb99c6bc3df70484f094331d0f825a39cb2e45c32819a3b29b98c8fc316b608ff6e98628bce03c7d745d16895b6924c7108bc44bbb364fd4593fc3b0a49199f82ed14a019df58812efbf5a116a594f596b5a67f38fb4130fc0d82f3d2872aa197f117d6a5b9f95e75fb7944ff13ea15aff2dcc9ddf27778f32731c670a76f3fa5cb1bfbc1dbd0c289bb2c717670b330fc3bd36dcfbba420babed84c362d68416a9b1076ba96eeec6cfe6b04429c2f0b361802a8b6fd2145c25875464f3a44cc1a1f8a76beafeea3afc79db0e8fdcc6f3c9d46cdee983a18e1d22ecc93ab2007bdc3ba7421a7fdc8ba9113d8ea7c0206f5d095d4344e68f66cca95b07f1ef9b7a0eb354e194fd0e2cc693d755fd719835b8094affc629282cf6522ddb14189227e2167e8ccad461be828791eb98373fbf5f5d773f34ac1b3843ab687299321e3a1a19a5a3384c23d7a3e7ccd52a9217900b5a4bbd16bdfb866ae28999ece4a05518c9a3081f13e0320872d0 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80\Blob = 0f000000010000003000000082ef60cde833832df196a3351df5b2b90029e31f679cec503aeea7ca8893db9d81d4e576a9f216dd0baec61cb02a14600b00000001000000380000004400690067006900430065007200740020004300530020005200530041003400300039003600200052006f006f00740020004700350000006200000001000000200000007353b6d6c2d6da4247773f3f07d075decb5134212bead0928ef1f4611526094153000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000680193b1d24a40426994462c1c5a88a925b4474f1d0000000100000010000000cfa020613a558555d3c1ea201f6276da0300000001000000140000005eeed86fa37c675230642f55c84ddbf67cd33c80200000000100000068050000308205643082034ca003020102021006cee131be6d55c807f7c0c7fb44e620300d06092a864886f70d01010c0500304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f74204735301e170d3231303131353030303030305a170d3436303131343233353935395a304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f7420473530820222300d06092a864886f70d01010105000382020f003082020a0282020100b6337380d8620370142c111c395e7cae7c83861dfe262f4c24ad8bea835fa9bc3d5bfc0b984c024730ece2feece8345b665ebf3bd72ca625ff8c59b3dfeada7c29d9465072081d6ed11b0add1fcd9989fa0f0f73c4e19c1d7532cd6f97da2a6a95b26cc909d0ea0b7b7d17064999efd6dee0c853d4aec677f186bb231cb8c0df59f78e7dd1ef82e6268b5a38b5ff75d5b2d94f09f3378850da11a48a1414d15304007df36a4418fe507032071ca89a0e3a1dc50a1f6e0b2669b73ca257702c86fa4c6e95a95843b9ac12d6ff3fedd743176b4cce9ec490abfffa10509aa39057d6e78c10ae9f161acf351d7fd776ed8a9c35a728b8a75d21fc3037ddde08194f15c6e7a6da90478ef794534c8e5302befd99e5ea86d0af0302d39baa93f1ab288e2001ff4cfbccb72940f587a41213051f436ed751509f38b420ed1709128fccb919af9fcdbe6911d3af55106d1786799652c6b2009de5af38b035f4886b8f0e043d7ceeafcdd36a104ac6cd86ca223da14a5cfb0eff88df5c62a7c0b91ed9ac6c7e3837fe779325c2858a4fb537065a068114f1ce949d9991ea325ace673d6e0466ad0c4f2da32ef79ef5789df70afd7e8fe3428a5596bcf19f372dfc9e5f95fe8c181bfc8efd4b90afd703681263ace293a7a2cb04e54f64ce03fac6149fd98be8ccd4628c6be4002c199f1a06c6318154fb53249aaf5599ba9d75aeb8c2dd0203010001a3423040301d0603551d0e04160414680193b1d24a40426994462c1c5a88a925b4474f300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c0500038202010092fceeb802791702517d21c54967a7a4f1a82438eb0c68ea5a426b9cf473c1694a2db33705504298929e06792c2e0699f6efdf2ba0cdb3920183b5a0cb27b53c231a9849a2ec2d99a55943acd2b193d657d71cbc93d6c640e1b36f1955b713d7e54333a4b5abcbdac131640d74d62cedc38d6eebbbaf194761612dc0f405b96f78dc3af74240655391bd990d939254a6a937592b9bcb99c6bc3df70484f094331d0f825a39cb2e45c32819a3b29b98c8fc316b608ff6e98628bce03c7d745d16895b6924c7108bc44bbb364fd4593fc3b0a49199f82ed14a019df58812efbf5a116a594f596b5a67f38fb4130fc0d82f3d2872aa197f117d6a5b9f95e75fb7944ff13ea15aff2dcc9ddf27778f32731c670a76f3fa5cb1bfbc1dbd0c289bb2c717670b330fc3bd36dcfbba420babed84c362d68416a9b1076ba96eeec6cfe6b04429c2f0b361802a8b6fd2145c25875464f3a44cc1a1f8a76beafeea3afc79db0e8fdcc6f3c9d46cdee983a18e1d22ecc93ab2007bdc3ba7421a7fdc8ba9113d8ea7c0206f5d095d4344e68f66cca95b07f1ef9b7a0eb354e194fd0e2cc693d755fd719835b8094affc629282cf6522ddb14189227e2167e8ccad461be828791eb98373fbf5f5d773f34ac1b3843ab687299321e3a1a19a5a3384c23d7a3e7ccd52a9217900b5a4bbd16bdfb866ae28999ece4a05518c9a3081f13e0320872d0 Setup.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeBackupPrivilege 2644 SophosSetup_Stage2.exe Token: SeRestorePrivilege 2644 SophosSetup_Stage2.exe Token: SeBackupPrivilege 2644 SophosSetup_Stage2.exe Token: SeRestorePrivilege 2644 SophosSetup_Stage2.exe Token: SeSecurityPrivilege 2644 SophosSetup_Stage2.exe Token: SeTakeOwnershipPrivilege 2644 SophosSetup_Stage2.exe Token: SeLoadDriverPrivilege 2644 SophosSetup_Stage2.exe Token: SeDebugPrivilege 2644 SophosSetup_Stage2.exe Token: SeBackupPrivilege 2644 SophosSetup_Stage2.exe Token: SeRestorePrivilege 2644 SophosSetup_Stage2.exe Token: SeSecurityPrivilege 2644 SophosSetup_Stage2.exe Token: SeTakeOwnershipPrivilege 2644 SophosSetup_Stage2.exe Token: SeShutdownPrivilege 2644 SophosSetup_Stage2.exe Token: SeBackupPrivilege 2644 SophosSetup_Stage2.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3460 wrote to memory of 2728 3460 2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe 80 PID 2728 wrote to memory of 2644 2728 Setup.exe 81 PID 2644 wrote to memory of 5308 2644 SophosSetup_Stage2.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\SophosSetup-1856789882\Setup.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_21e683da416e1cb4b10800ba19eaa971_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe"C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe" --mgmtserver="mcs2-cloudstation-us-west-2.prod.hydra.sophos.com" --telemserver="t1.sophosupd.com" --diagserver="installer1.sophosupd.com" --logfile="C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20260522_183016.log" --parentpid="2728" --products="all" --customertoken="da6ab916-ebd8-4676-b549-37e2c410b695" --pipewritehandle="2104" --mcscustomerid="dbc797e2-286a-4735-9150-1dd20d6f45a9"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Sophos\CloudInstaller\SophosACSenabledTest.exe"C:\Program Files (x86)\Sophos\CloudInstaller\SophosACSenabledTest.exe"4⤵
- Executes dropped EXE
PID:5308
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl
- Size 525B
- SHA256 3484fe4376803d32c56ba6a850d330651be49e4b69e4de901b2100a80c25d9b9
- MD5 48ad0fbb2e473628ca6fbe5f40c1b335
- SHA1 4faab71eaea67497af28a8c1fe59e783a431752f
- SHA512 dca8268bb18f3219dbde371f59e6cbf5c622fedbc8ca450c433b03b2c1d87dd599da1c7bcd022ffbf6ac4d0d75b779603874ee1abd594a145214d05642f65f9d
- TLSH T183F0C0F30A79339416D8BB12838CEE6DBD32E665584D960BDE64CE82D4817F05190558
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt
- Size 1KB
- SHA256 653e1a599023b1eb88ab96137238d978529a070b828dd3309800bd131d8ffaf3
- MD5 9608edf834fe19c2bf34cc00f954eca5
- SHA1 2277ed5594d385b4fdb3f532e3a48394c1c6f1a2
- SHA512 a1cfefa8f12f54ab1d1b9e67e0893f2f4cc85bcfbcf9deac8f3eaef699bf336c11fead3ceb0e37453f3b5d7108134870c62494405349de4b0661725f5e0e8293
- TLSH T1092111366FF971023EBD9600B398E91C5E31595430585C4F787CCEE69CC276124D4B6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl
- Size 475B
- SHA256 de2c59c12a1774610b6c0952ade122028f892dc14bc6b568a44b2220897320d7
- MD5 4512cddf97293ca04baff2337da700b6
- SHA1 84d37d4cf345d38182ddf54c928b7d981c75faed
- SHA512 eb90655188ed2cbd8bfad3cc901c6a0b51cab84ac82201d87a8611366d61d12d96fea3a5ac1e4ec9f048906bb72dc16f1ab19ee1eaafe962c547458f57157bf9
- TLSH T104F00E316AB9380028C9AD30975DDC0C5C31F610B808607E6AACC8E495853A0629062C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt
- Size 1KB
- SHA256 92e6ccbe80f31db683e4c331b599efc91e593365af8895504a9360c087060d44
- MD5 450b9d35c9a0b33f80d9e8faa29a260a
- SHA1 1f20ecb65ac24cb20512c9c4983dcd9bd0d05b6c
- SHA512 4baa881f16f4acc75d71f79c36c503ab6e3008574e2dbd3714001cc217f72d0b430f651ac2b99cf5382b9d3f7eb625767a2820d62bcc3f00fff515425b6dfce0
- TLSH T1D62111134EF7340175FCE590B3C4CD2AADB1625C2A052D6EAC3CCAA79E50330199C1BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl
- Size 738B
- SHA256 d1fd764f8a1bbf5fceba137f1b09eb6b76ec8f868c60b176db43ecc0d40d2797
- MD5 9dec7dba2a6449fa5457740fbef79d01
- SHA1 a8e7da73b454e2cb3031d8b45df4748541f56cdd
- SHA512 fa91a1e75ce9ad1860f787e54a20c719498706eeca11d9fb14d5095c6b88be64afe836a772ce6bfd739a5c1ea385c353fc99704d5c82cb51c1b90c5e857d0c27
- TLSH T1D001B52A3E08B0022D790E2C7388EF802C32A3C82D028B1F80BCD6CB949F374911C1CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt
- Size 1KB
- SHA256 ab9dc99032c498691a788817d5af925ef0580f32904defe58b7a52d971d8bec4
- MD5 608b95a5138684796fe2b57ad00dac03
- SHA1 0a2996f1d26f0e9e3a90c333dc7acc3830d3b365
- SHA512 978c8743174ebe5de00eea6f8d0a9b45d8cc834c0dcd3050dd24d7386f81f8270c50094de5468d529765ab2ba6484378ec89f8b1b8a954845890168a9284c0c5
- TLSH T1DB31C9572FCF30123DAA9F085FDDDE530C21AA0028B14D1A7A784C53AA782620898339
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl
- Size 738B
- SHA256 91a8b79af85e5a0d451e35ebb5214038777ad80421115e2d6b4f915fef1981a1
- MD5 4c6122725ca25070dc5352617795e105
- SHA1 2a3aad2fc6e231e3109ed00467a77c2de570450d
- SHA512 75ec1d542e175e95b2d5a43aa0a855432e54993568bd6e95a1223deab3849cc102733628845ec02c68104d654e083ac59266da97f93ef321131be929fd3a7e34
- TLSH T17A0165D70B1E3B90BC58AC544785EC09AD2AACC40CA2B59E12F4C49B8C41AC154D921A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt
- Size 1KB
- SHA256 4d44a6ba0ce8fc3771c6bc95d385aaa944aabdcd2d908d87ef5ca20418bf5d90
- MD5 150c183892de69bdcbea89e8f59ac9da
- SHA1 a368d1bdc8c44eee589320656200ef2bf597d69f
- SHA512 dbba7932d861b5dad1e2ed53a643c5d35baaf1460a58a10486de92b5c7d722a570af5fce631c0f96bf4f6d7f4c4de4e2980b0f34b0948bea9c7f0a15198eeb26
- TLSH T14F31A4338F4E30943DF49F426BC8EE060E90A65455C66CAE297788558E71BB43088B3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl
- Size 538B
- SHA256 1e5bbba37fce10c210b47f976c1980e366e2cc2456f2f8d575c3226bc82c166f
- MD5 c358dfd5a0408001fa7be2bbb6cba7b0
- SHA1 48b50717f2c65cb77899dd5409a96d69a0fd888e
- SHA512 7995704f27e45d1431ae716625a5a887cf85995b108a222fcaebabb03d0dce24a448675af96ba664c9b897589432d27272567425c36200257c1e423244d3f5e2
- TLSH T1A4F0C0531F47F2426877FA52E7E357C6C501D085988A9C465C9208A3B9C09DBB28D4C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt
- Size 1KB
- SHA256 89fb6464ac6a0d507b7486922b35405b35f1d67844a2ac3662ba10cf3ecc7719
- MD5 0c3d972fecd78f696776d45ed59c392a
- SHA1 300d7d2da297f2f641e150ebb86cf3df589e8c70
- SHA512 b4703078c26015b9a728772ed057d16cfc54bb1e4181c4007949d60d5467eab5398f2041d95108b25a61ef9076f4653d83dff3260dbc97f6d3b2541fce07b96c
- TLSH T1E01135A7AF25F403389794337FB73BC81646D4549A49F4C86C062C32ECC56B3E035485
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl
- Size 1KB
- SHA256 df876aff0675399c4a496c66ca67bf16fc808f9fd9f9d5194c7f623898371d2a
- MD5 c3c2cd850f17e5f8d8621076609a5a9b
- SHA1 eacc79e5dc10ad6627c00772696d4a1e51c8bed8
- SHA512 4df9d98cad2f739bd39231a7875ee148403bb15a91b5740c278d2bbdc120a0191d9be2ce3d5781cae5a5dc3637c383c7e6cf5dc7d1bca6006dc8f2b448fa9da2
- TLSH T1C121A7BBAEA071978816D2446CCA0EC19105A5284641E40148222C41E821FDBF0EC4C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt
- Size 2KB
- SHA256 4ff561d6a910eea25e2c15d8b0139485680e1730c922ceb0fdf51a76e808b359
- MD5 acef53d4645e4c018481f57a04cb2f8b
- SHA1 5a7e2584c0728e82182f5e8a7294f0ae695c1b25
- SHA512 bf41b8d1ea65054566230ef3a0b7dfd04b8397e4594a81a8b5796bcbdadd973b0b090f6f1f6be67ce1435b57c21249b4babc4d669c7a35f98d84411e8f833bee
- TLSH T166413CD7EF65B3412C7BDAC8B1CE3134999479EB2DD852FE705220268420C31623DC4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl
- Size 1KB
- SHA256 865c9e89a44090820ac85ef791428b807e023ae7ccd23aeeff7e3e98fe552ea5
- MD5 ee71956f99740a9e15bbbd4e71b76f2f
- SHA1 2f848ca3ad9d0345ca9c08748a8f4f457ace08ad
- SHA512 5d0393fef86ba0188b63842c37dc71adbdf71b87dbb29d41dcc68648272bf51f1c2f4054106fb33b2033ac4c6859bb2d3372aa33e61cf1eb547961d9886ae9e8
- TLSH T1CB11B6D38F9074CA3127C480AC0A08F7AB12404B87F5D418575AF29247DABE89C1D9CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt
- Size 2KB
- SHA256 a034c29f8b46a303216f9e3a52aafbdedb864dede8cf632df05fd6d10e381fdb
- MD5 75a97f3f179ccc3a1b8617b6938b38a2
- SHA1 9f6c3e0a399e9ff5ad70a85ae6310a2a2367119e
- SHA512 5488c0440716d37ea4dda10fad6ed4ce21d613c7aec9588741aa8740e2440e3f7ef1b6cd49de851b38153effe8943c8743aff8f57dcede25870528b7ab550250
- TLSH T1E6413CD1CD50FCB76F239CC4E6CF016C4523110B3ED6F85100A7288905F978D25F4495
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll
- Size 2.0MB
- SHA256 e172d4906871135bc0f3a691d77e36f26dafa749bbea58b9b0f719bb9873cbbb
- MD5 d423bba8a9e44fdfdca1cbb1697f6e63
- SHA1 1116264f21ae4cb9dd4292de0bdf2e20c4a8f10d
- SHA512 de4bc0b8fc5e1e383442693a648dad938929b0a93271edeef24bd5727fa65ff8eed7dac712ec174fcea48a4fc7b8c98694b27bdbe6482125f7724815549d72cd
- SSDEEP 49152:Gn7O9HSgsvbd9gFvk9RvockPkOtd9o/+Nrwi:G7aQzWvootPkOtUS
- TLSH T14D959E22F545D033E08A01B2956DDFEE86BCA63107B114D7B3C8AFAD69256D36B31B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe
- Size 358KB
- SHA256 8c844446d9ec974e4ae419af40b1c865e2e7fa61917390578fce5b2e534d6060
- MD5 8ab0c824b251fea3168b065c92b93268
- SHA1 5a403c72b0d09ca894843fb02133075bd42d8828
- SHA512 b8536cf9580c6cab41875e73214405216568b63ea9de270354f38aba0fced015a37b0b9d620a4cda621e1476a36073a84cf492d8633d7f8c81a0a09f99376123
- SSDEEP 6144:rzecsLuDyrUlKYOOAhhncXRNiF6VWZslQEtwTVCGY6HCrRxpqT3:PebwAhhcXRNiANwZCX6HGRxQ3
- TLSH T194748C1DBDA1C472D5A3093698B4DB27E93EBC210F6026C76F843EBED9316C15B36602
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe
- Size 4.5MB
- SHA256 89e9c53ee2a5a908638719820be3d3c47b524ba6a21f1ca0edf5320c384729a0
- MD5 48d058c11c23e51ace5f6a8696b58fd0
- SHA1 cb556cee8c1ed2bbff4be5285cc718dc62137a61
- SHA512 2055067f6e7b39e1c581481f16f714f432c0abe4dab64abf02460f8c2c6e26e59a46cc10116a557c7a279c85756e73a5f6707f2821bbdb2233abcfd741693b0e
- SSDEEP 98304:BnQYfZPEyCi88dzV35BRMi188ebTT3dI+ui:BQYfZP988dL/MY8xTtI+ui
- TLSH T195268C35B905C032E49203B15939DFABD65C9D350BA164C7ABE87A3EA5345C32B32F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat
- Size 2KB
- SHA256 af9ea706ef76bd22f7d54e3cd35be4aa08edb6d0a15e135f1a668cb690d15814
- MD5 2364f8b3e085a68889f0e36e8b05952b
- SHA1 0084cf5b53e55a634815e8200745112f0a508245
- SHA512 d50250d781e275c7e50f150266d1c2ce5f1bf0c47f030b53185058f0a331c889604d077f5eefa52a943ccd3e84ea61aa4b2b301abdc7b10e04ff57646dccf8de
- TLSH T162417651CADB6DE253F23395032FEF685712F84B2EC85D982BDA810B1601F045BD41D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat
- Size 12KB
- SHA256 f9e974a970775f77b79b2ca2de38311a2bf75935802187fac14e2884f714c5ec
- MD5 5a67de2fd1f337127d543e4660a271be
- SHA1 546d0f2f86530c80d6db11864b1f08c352564aa5
- SHA512 416b0c28babc2c03392832305e5db1b6a49d1da677d53cd651cbd1b4813ee50f20898cabc4047dccb1371705be38f21a18f4dc92ab34d16f2969fcec4f6996dc
- SSDEEP 384:T+71nbf58DA7JsJZicXqDiBxD+mz4Cu51Kfau0FVWLI:TY198DA7JsJLk6DNDU1KfapCLI
- TLSH T19542AF7A5F5138882C7B03CB958A60745D0E07AEDAF7F0891C6A7E639289FD52271894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe
- Size 2.1MB
- SHA256 f566d405960a5411edad61607206e429a0d2af72ba122a0f9b4bb02eacd16df6
- MD5 aff724b229550a5cf970a821e6dc68c9
- SHA1 310b994a816731d2a5f19f4de7c8164e1c3f9108
- SHA512 6f68f7a0cd9efc819b1b5e9a526540574932c4420f0d5c93ed5fd5ea139345ad5cab7144b774db7ebc5c8734b2cb93b1d1cdbadf94393520374d19d78b797eab
- SSDEEP 49152:f2sc+iVj9Lwyyw+LLBzxKgIhPVbIReic6nWn:fsjVjBddh9I8
- TLSH T1E8A57B3A7D40C136E58201B1897C9FAFD6ADAE340B6124C76FD87A7DD9344C22B32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe
- Size 2.4MB
- SHA256 f3e81df82a283e20c1d5fd92d13ccf725c8a4d18292d659991938f2ef5e32127
- MD5 b1c71fb5b6f7b1594265809f9debd2d1
- SHA1 504405384f3ec6b2c922fcba6098249e24bf792c
- SHA512 c4c263fef71114105ca430bc89dd3920d738a08d3dfadc922535250d01d9728d46ed87da7ecf1713b2b2f37e415ce6e6a20521161dad8b4777037a98b5262aaf
- SSDEEP 49152:sgnLMqKqSISNYVIgWaQehEWBcFisc18lTw176PxbU58ykz:ZnmgYId+lTI6OQ
- TLSH T11FC57D2EAEA402E8D07AD1B9C9525507FBB27C0503616ADF0ED07676DF37AE05A3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20260522_183016.log
- Size 13KB
- SHA256 492a8981e1bf0234f431dd03f7aeaa346b20279bab58ade6f2a70aadbf1db70b
- MD5 d877b71e494700598fe4dc32577b9dd8
- SHA1 1a855227520a08c059894352850edfb7a56608f2
- SHA512 bfb74af4c0a88d7d5d2237b8a70c77438082a3f40b886487bce6c1fecd48a9ac3fc03c4c38ba625b20d9e9e376ee7f8d7100617d0c8c2d593788345669a91e6e
- SSDEEP 384:mtc2K+eeYTWHLJobwzmNEwt1h6O+YKySklbTcu6XmoSwP/sfW5/sXOh/lbDstxuR:8I+jYTSLJobwzmNEwt1h6O+FhSbTcu6N
- TLSH T18352560E5BF268B23D5F9152930A3D7B9D2F3C0623DCE880BBE9F5615281531D9E9DA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SophosSetup-1856789882\Setup.exe
- Size 2.0MB
- SHA256 e6a66e2fab1e2b296305e94f84ac2251bc35c286f712b91f6fc580423e130a78
- MD5 d2c91684523793cf11759e3e92635253
- SHA1 db8ace9ebc325b866ea91531de6e64b4fcb605fe
- SHA512 68b6cf08620c9fff114c3ac620ad4dfc94704db36b8c85e8cc7f48b975bdf2a8fdb2964a5717edc8808d65a29497bef322725da916499fe2f99173e5a0a4e90e
- SSDEEP 49152:IZ2tQtfWafTFr/k5B4iWcIUOY4zzoCFKGEDtT6M:IZ2tQt3/WBp5qIeM
- TLSH T1CEA58E2E7D45C032E96211B14A299FA7E12C6E39076254CB6FF8793DD9309C26B37B13
- MD5 SHA1 SHA512 SSDEEP TLSH