Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 23:26
Behavioral task
behavioral1
Sample
2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe
- Size 1.4MB
- Sample260804-3e4c5staja
- SHA256 1107f1ca2f23c5194fa1ee10c32c1baa3b75ca9bd83f85a8a638c6b78fb1f697
- MD5 085a31fcb8d903125d3f94e43d3968ad
- SHA1 8331d20059d1381b9e49f725cf22d84da775a1a2
- SHA512 92b89ada7178ef2e2b5fbb88076272014aa6017aa4ecbc6a44c32f9af48b6dae957cb8f7f38e8a89635d22364b585e7c6c158cc8bcbcfb3874a534df700a9a83
- SSDEEP 24576:xKqHgnhSC0badP0QiPYnSFELlFFx0A4cAhPSNfL1JD/tbOFmHOJA:xKqAsadP0QiPzEz0AVISNT1JtMyx
- TLSH T1E8651215B6E0C431D4B21E345C6086B00ABEFC310E755A9B13D86A6DAF74ED2FA34B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detect Neshta payload 10 IoCs
resource yara_rule behavioral2/files/0x0007000000018868-144.dat family_neshta behavioral2/memory/1468-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5356-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1468-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5356-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1468-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5356-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1468-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5356-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1468-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe GoogleUpdate.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 13 IoCs
pid Process 2416 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe 2812 GoogleUpdate.exe 5396 GoogleUpdate.exe 972 GoogleUpdate.exe 4900 GoogleUpdateComRegisterShell64.exe 5432 GoogleUpdateComRegisterShell64.exe 4160 GoogleUpdateComRegisterShell64.exe 5660 GoogleUpdate.exe 5356 svchost.com 2428 GOOGLE~1.EXE 3368 GoogleUpdate.exe 5116 GoogleUpdate.exe 4468 GoogleUpdate.exe - Loads dropped DLL 13 IoCs
pid Process 2812 GoogleUpdate.exe 5396 GoogleUpdate.exe 972 GoogleUpdate.exe 4900 GoogleUpdateComRegisterShell64.exe 972 GoogleUpdate.exe 5432 GoogleUpdateComRegisterShell64.exe 972 GoogleUpdate.exe 4160 GoogleUpdateComRegisterShell64.exe 972 GoogleUpdate.exe 5660 GoogleUpdate.exe 3368 GoogleUpdate.exe 5116 GoogleUpdate.exe 4468 GoogleUpdate.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GoogleUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GoogleUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler64.exe GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_bg.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_it.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_zh-CN.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.352\GOOGLE~3.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ml.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleCrashHandler.exe GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ca.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ru.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\psmachine.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ar.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_el.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_hi.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ko.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe svchost.com File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_sr.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_fil.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_iw.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_sk.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.352\GOOGLE~2.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE svchost.com File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_ta.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_nl.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_hu.dll GoogleUpdate.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateOnDemand.exe GoogleUpdate.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_zh-TW.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe svchost.com File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\Google\Update\GOOGLE~1.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Program Files (x86)\Google\Update\1.3.36.352\goopdateres_sw.dll GoogleUpdate.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.com - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ca.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_vi.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_cs.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_iw.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ro.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sk.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\psmachine_64.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_el.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fi.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_no.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sv.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleCrashHandler.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\psuser.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_da.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fr.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_is.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_lt.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pt-BR.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hi.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hu.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_uk.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateBroker.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateOnDemand.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ar.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_et.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hr.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_it.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_nl.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateSetup.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdate.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\psuser_64.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_am.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_id.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ru.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ja.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_tr.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_zh-CN.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File opened for modification C:\Windows\svchost.com svchost.com File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateComRegisterShell64.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_de.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fil.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_lv.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ml.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_mr.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_gu.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\psmachine.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_en-GB.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sw.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ur.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_es.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateCore.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_bg.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pl.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ta.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_te.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_bn.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_es-419.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_kn.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ko.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ms.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pt-PT.dll 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe File created C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleCrashHandler64.exe 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOOGLE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5660 GoogleUpdate.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ = "IAppVersionWeb" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA} GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback\CLSID\ = "{ADDF22CF-3E9B-4CD7-9139-8169EA6636E4}" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ = "IJobObserver" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ = "IRegistrationUpdateHook" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID\ = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer\ = "GoogleUpdate.OnDemandCOMClassSvc.1.0" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CurVer GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachine.1.0\CLSID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\VersionIndependentProgID\ = "GoogleUpdate.CredentialDialogMachine" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0 GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassMachineFallback GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32 GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods GoogleUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\ProgID GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\ = "Update3COMClass" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\ = "8" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}\ProgID GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E}\Elevation\Enabled = "1" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\Elevation GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\VersionIndependentProgID GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods GoogleUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28} GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\ = "4" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}\VersionIndependentProgID GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID\ = "GoogleUpdate.Update3WebMachine" GoogleUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32 GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\ = "{6365D39F-2E73-4837-BC59-2014AAA20FA7}" GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221} GoogleUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods GoogleUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\ = "41" GoogleUpdateComRegisterShell64.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe 2812 GoogleUpdate.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2812 GoogleUpdate.exe Token: SeDebugPrivilege 2812 GoogleUpdate.exe Token: SeDebugPrivilege 2812 GoogleUpdate.exe Token: SeDebugPrivilege 2812 GoogleUpdate.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1468 wrote to memory of 2416 1468 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe 89 PID 2416 wrote to memory of 2812 2416 2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe 90 PID 2812 wrote to memory of 5396 2812 GoogleUpdate.exe 91 PID 2812 wrote to memory of 972 2812 GoogleUpdate.exe 92 PID 972 wrote to memory of 4900 972 GoogleUpdate.exe 93 PID 972 wrote to memory of 5432 972 GoogleUpdate.exe 94 PID 972 wrote to memory of 4160 972 GoogleUpdate.exe 95 PID 2812 wrote to memory of 5660 2812 GoogleUpdate.exe 96 PID 2812 wrote to memory of 5356 2812 GoogleUpdate.exe 97 PID 5356 wrote to memory of 2428 5356 svchost.com 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdate.exeC:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={B5A1F860-C0D9-8646-CE6D-57774122294E}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5396
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4900
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5432
-
-
C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"C:\Program Files (x86)\Google\Update\1.3.36.352\GoogleUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4160
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNTIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4zNTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEM1MTkzQzMtNzk4Qy00QTU2LTk1MEYtNTcxQkZEQTdFMkJFfSIgdXNlcmlkPSJ7MzJBQUQ5MDQtODc1NC00RDE0LTg3MTEtMkNCRjA5RThDMTdEfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezlFNkRCRUYzLTI5RTMtNDc2RC04QTc4LTEwNjIwOTAwMzU5RH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjE0MS4wLjczNDAuMCIgbmV4dHZlcnNpb249IjEuMy4zNi4zNTIiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7QjVBMUY4NjAtQzBEOS04NjQ2LUNFNkQtNTc3NzQxMjIyOTRFfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5660
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Google\Update\GOOGLE~1.EXE" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={B5A1F860-C0D9-8646-CE6D-57774122294E}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{4C5193C3-798C-4A56-950F-571BFDA7E2BE}"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\PROGRA~2\Google\Update\GOOGLE~1.EXEC:\PROGRA~2\Google\Update\GOOGLE~1.EXE /handoff appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={B5A1F860-C0D9-8646-CE6D-57774122294E}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty /installsource taggedmi /sessionid {4C5193C3-798C-4A56-950F-571BFDA7E2BE}5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428
-
-
-
-
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3368
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:5116
-
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4468
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- TLSH T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-04_085a31fcb8d903125d3f94e43d3968ad_amadey_elex_hellokitty_hijackloader_luca-stealer_neshta_.exe
- Size 1.3MB
- SHA256 905934ee31dec5753f49f47b936a349a727d9b31e558847e86f335dce914fb68
- MD5 e9a84304ea61c3d1a3d4bf87f6f0e23d
- SHA1 4dfdb47480c9eb2142bf5ae902c0356aa081c246
- SHA512 1854f7cff23cdc3c3690cc3d1c58660d6fffe92f7a0cdafc26e8b75709f82696d601df52e047119f4b77597ec70f5bcd07cd901aa600194918c4cf8c97323bb6
- SSDEEP 24576:HJvKqHgnhSC0badP0QiPYnSFELlFFx0A4cAhPSNfL1JD/tbOFmH:9KqAsadP0QiPzEz0AVISNT1JtMy
- TLSH T1E855231876D08431D5B31E345C748AB00EBEFD314E259A9B13586A79AFB0DD2FA30B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleCrashHandler.exe
- Size 294KB
- SHA256 24dfdf400d8514d3fbfc5f4aa5dd2143f38b160ad142417bbf83e4d2e425dd0c
- MD5 8eb5a3bca26acb6688a0cd7b35cfdad9
- SHA1 209c79d6b18a00f378efa75c7a3e44686f1850a1
- SHA512 9dc20a43174f103ace495986cda9870ed4b899c74fe85cfd941fe2cc312e883caf9d0f8835fc59f8a7fd82ee350e479896fb31c7d0cd170ff6932fd9e24a0417
- SSDEEP 6144:jhPLlZpRkTpB8HHvBjruphfgesnAhAOQp2swckjQx+W8:9lnRklinJruphfg26p2swix+W8
- TLSH T1CA54AE0276E18072E97216325978BE6259FDBD300931CAAF13D85E1DEF31681D63AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleCrashHandler64.exe
- Size 392KB
- SHA256 ce1dd1ba63273aacc0d1ef4e25d8338577d612e88f27d29466168099d3548342
- MD5 15c1cadd3729ae6a4c1f8fa08d61bdc6
- SHA1 1486f4eaa1b41b0f2101559ea24630d002bc2d25
- SHA512 70eb764a53647d178278c743f964e03671bd445cc121f8e5a5b17441483b8b150ddf0d91316b8da1a7e289f6d6ebaf7f4952c8745530a700d21269309807f341
- SSDEEP 12288:QnW3gaHC2zUM2WJoROZVXk8hbodzbZw8x0Cx+:QWx5k8hb0HZw+x
- TLSH T1D2848E15F7F408F8E4B79134C866CA4BE6B27C9A0670D79F23A886961F336614D3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdate.exe
- Size 158KB
- SHA256 1f6b69d11a3066e21c40002a25986c44e24a66f023a40e5f49eecaea33f5576d
- MD5 bfb045ceef93ef6ab1cef922a95a630e
- SHA1 4a89fc0aa79757f4986b83f15b8780285db86fb6
- SHA512 9c1bfa88b5b5533ede94158fa3169b9e0458f1ceae04dae0e74f4c23a899ce27d9109bd298a2053fb698e2ed403f51a9b828ee9fa9d66b54a18cd0d969edc194
- SSDEEP 3072:mwzvOYZt5YP/aKavT/DvbEvK9aobNI2B+JlIjDe7kal2n1TWl9o1B0C98CqtVFih:5tiP/aK2h9H/B+r
- TLSH T148F3E71276F8116DF0F36B70A9759B529AB9FC33EE20DB6E1680066C0E30941DA61F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateComRegisterShell64.exe
- Size 181KB
- SHA256 f318deb222e9f635f3a7b7de3202169732ebdb4ccf0be5fa8bb94e2e83913b74
- MD5 4b0bf7525348fd3b55b189c42f90633c
- SHA1 3861f8dad235032ff0d68065fde4082b379f02b2
- SHA512 ae87acaf33c4cc1a1368b427128432b94a8030f8837490ecaf6a394a5e2e5a9340e243f436b894fa269a8bec3d22da93b9e480d33911938e995055c3e7a8cb76
- SSDEEP 3072:bni3F8I1rXRAmWt9h8QlLISqG+T1Dpd9qEKLmoY46WeJsB+O3dnDjHP:bni3F8QrBAmWt9h8QlLISZWVRohcA7dP
- TLSH T12C047C1A73A924F9F1738038C8515906FB3374650770DABF03A4837ADF77294AD2AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\GoogleUpdateCore.exe
- Size 217KB
- SHA256 b8ca3d7d6f8f875b88128f9968d7ad2718300115c1bf455fcc3d128c923b2c14
- MD5 e0e328e353efdfccf4aba39bed38ae5c
- SHA1 35388f3a1d5f30b913e5ec442ccee88a03df11bd
- SHA512 32af8dcb139f1c0dc0e23641ad8f87e9cda2071c001405db6a44fce2226a189217dcd5aa47f260eaa3d482aa8bd20f797fc7cb48b3e9195be9e0dd94e79651b5
- SSDEEP 6144:0gG1da6edDwCtJmRqyFmB6AOKmigGwIAfx+iQ+FfFy:/G1da6edDw6JmRI6BiRwpx+iQafFy
- TLSH T18A248D12B5E180B3E9B3193409F4AE759ABDF9310B258A7F63D84F6E1F30681D216763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdate.dll
- Size 1.9MB
- SHA256 e80fce87f2f4b87282fa38260acfe5435e47fd2e0884db4c7446ac00635a7ccf
- MD5 2fa183e7b8b744b6761a008f6bc56b87
- SHA1 63696ad0541611afc3fb61abdc9e1474d044625a
- SHA512 8b2fbe57ce75348d6606d0beaf2f69452f7480ad7b9a914b5a9c1a6624d2e32df757e3002c5eb26515a9bd35bf84586dbf6272204ef56c3a6e9a541b14aeb338
- SSDEEP 24576:kYG7K9TL9iSQCDv8ivLDgpYpk9MRS+MKMGAPG4tyRwLs57kcJrVhW4LfmiMg9fv7:kNe0JCDCpmqOSBTLsrJpNzmLg9fvw
- TLSH T15595BF1372D18031D1A71334AC6D7B2A5AFDBF240A258B5B17D83D0E6EB25C1DA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_am.dll
- Size 42KB
- SHA256 cd426d502f1b039f4d9bb8c199271c68b63700cd2203567be7f3324a5755654f
- MD5 6b662cf1c75bf32f3f26a945c3f420d9
- SHA1 a410ed831e4cd56b8d108be5ee193be3305d92bd
- SHA512 b5937a1513012b3b74f52348f67bf26415f311c8a5a7506ccf43d8724848629a1f3c16fa8e2ed251332886d32f9e8a423cbe0d675b2320104131f1760d144b8b
- SSDEEP 384:IZrM4k4sI+h2cYIYi6yUfqznAM+o/8E9VF0Nygy:oMZJBBYi6yyuAMxkE
- TLSH T142135139460C5C0EE727FA31B5941D2E41675D8C5BE0F3921194A13C9E707236BAEF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ar.dll
- Size 41KB
- SHA256 41a395dc1c9b6e10a32e39fc9bcc3c45611b30723c5a895ab46bd2abdac31d3a
- MD5 adae3c47edd1bd2e078f46e7dd448ff9
- SHA1 e05b32b580286d45a9a3011cb209deed6fe964fe
- SHA512 c05774d97c45fad2821526f852035954fd6dd9f1320d958657201d3fb378f763b8ff075848e7513c9872405dbabb656895193efda26a2a7587b0ba014a9abe38
- SSDEEP 384:1nM+anBDBGHWIYi6ygp9AM+o/8E9VF0NyTu:S+anTgLYi6y0AMxkE0
- TLSH T1891340720918DD3CEB137A34D095CE3F916751D29DC4736A12A4A9308AB0722AB5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_bg.dll
- Size 44KB
- SHA256 b17e3507aa13334e21fb0fc98eea44ade4793a5b2edf2d76694da0772bf6feb1
- MD5 848d712a48ee972e87517818dede7e41
- SHA1 cf58fc4fd8d021f703ee7e5b1674b341059e65d6
- SHA512 7ca11c5a86b81efc72ef044ffc8bf90a0ce9eec5e25e36d3cf499059d6c0e54a44dc21cde7862b00381eebc55c5bba896f7263aefa321be4cd1f9cbd2ba1d5ce
- SSDEEP 384:f/HOtck8aGIZBOc8QIYi6yLtoAM+o/8E9VF0Ny/7R:f/Ol7D85Yi6yZoAMxkEn
- TLSH T10E13ED3BA5389908F745B6701A9589FE21677B9063E077C2528F7874A438331772EE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_bn.dll
- Size 44KB
- SHA256 825428867f14ce18169fe8705c0a5c941b87a7feec84f4e3dd4344bbe5fc7972
- MD5 1d1e2d66464c7237e667fc8813847d27
- SHA1 99f340f03747b025106a4ab40b1f19ba475d2c91
- SHA512 2f102a69d0fa1b2583a56a290d351551a0edd0fd9591a25c8e80c3e59df06b1335b0d3e4418416f089cf80650fad842c6a2d060bcee722e2000348083d00135f
- SSDEEP 384:IW9vUx7tVF7qTFoFrTFgRj+mBwm3IYi6y4Kx8ZAM+o/8E9VF0Nykl:39u0FoFXFWBwm4Yi6y47AMxkE0
- TLSH T19E130B3956087C0AE3ADB93476D55D2F09E3798017ECF35420D8A53889703B66E5FE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ca.dll
- Size 44KB
- SHA256 bd6013798ad45b2791c829e01ef74ce123cbdd138f298e7a6ec762a643340d12
- MD5 8a178eedd7627e0b655ee3714fbf6766
- SHA1 5b24081d284814005eaad0b158318258e2de76e6
- SHA512 524569f7acf97ebd56a6f04fa4b38497850c466f63ed6a2972e35d392e14a3c3c7e6e64a5f2e21e859d88eff55de637ce6aa0266b1bf316dcd7c37c966d516e0
- SSDEEP 384:C5Wc2yrzVu/k4bHovIYi6yrM2AM+o/8E9VF0Nyt9rJ:8Wc2yrBuVoQYi6yHAMxkEn
- TLSH T1A113CA3197E95A48F7B33F707874192D4A67799598F8F34D1240A1388970B01EEAEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_cs.dll
- Size 43KB
- SHA256 487957b3eb2daddf00808350c3cc52f8574ea585ea4a2ea742378b97ae4bbc71
- MD5 5cf5dc21628df3d52c372a3033918fdc
- SHA1 cf10f6f02a4e43a852996ea23ccc905192429bb4
- SHA512 553175a77c6434c93c638c3e5ea6ecd5a4d44f887e682aa2b57284e9a7ebeabcf652e12af08ee25d1ce393b6593930dff053232d1036b38ab8ddb605c7d78559
- SSDEEP 384:KcYmBWDqBkwEAuf2NIYi6yI3S4P4AM+o/8E9VF0Ny/Y:NYZj2aYi6ygP4AMxkE
- TLSH T18413DD7155B80849F7BB7F3038B00A7E196778919AF0F34E128051798970781EAAEF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_da.dll
- Size 43KB
- SHA256 70ca4eb73a4f8d03e750929a4afdb876076d39499f2016588f8b6fe85a80b0e5
- MD5 f2676455a6cc1749b55f904fef73cbe1
- SHA1 c8cdcfc7b253198acbbaf2a69328904fc07a6d2c
- SHA512 71b23fe2a956f2d8b35331ebbbf3d9e097f1c328f67af15d9a27315ef44421276bad40fb318d68764617e589296840c8f9fecf63dbe4bce1e527325ccec19bf8
- SSDEEP 384:Fr8fN3wtpOcqJ40dIYi6yKnCAM+o/8E9VF0NyQ:FU3wxo4HYi6yMCAMxkE
- TLSH T1EC13837153E84A1CF7B63B3078B9092D4967BCC199F4B35D228460788971781A6BEF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_de.dll
- Size 45KB
- SHA256 0f9022abd367d05db56b0b6158d4afa8b938ea78c87d86259544bdba83019af1
- MD5 35c9a26ea3cc527cf812edf6b20624d7
- SHA1 dec5b58d039cfe7992a9fa58cdd80a2b03128054
- SHA512 40b5c2c7b56f035fbd2aa28f0fa169b864279dd169f1e019a8454a8a03ef97b6cdb6a82de065a110c75c8c541c973085e7a7d30d6d3741840b89214f438919cb
- SSDEEP 384:vzAUy8gjhO4MesINK/QxhIYi6yb0WgAM+o/8E9VF0NycyY:LW1MeZsQx2Yi6yeAMxkExY
- TLSH T17E23527157E4490CF3B63B306DB45A2D5A63BCD5A9F0F75D228060788970B01AAADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_el.dll
- Size 44KB
- SHA256 2e01f0b326d233a14c8179ba8da32c6ed7b5edecac9ba19c4b110d09cc7c29a5
- MD5 0b607c22c8cfb0c32086c9dba5626dce
- SHA1 20d3278fe52514dce5c844892923a115de479162
- SHA512 601cb02e7249727cdcce01884932bdd7aecdc32322b8b4c1713747b7c0dcea3977036aa1e53cb1fd3239447ba46ec9a35c62ff5b94303a04ff9b3339fb316513
- SSDEEP 384:bxlEDleILkSIuHCSqlIxRFiAhkg8zBdfsBsTbM+IYi6yWW3AM+o/8E9VF0NyC34h:luZlLOWR5m/0TYi6yl3AMxkEi
- TLSH T13423FD7E096B5A19DB66B8F25462492E466BF0C208D0FB6631F07074DA7C7019ECFD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_en-GB.dll
- Size 42KB
- SHA256 38b97394a4a2d2ddbde72cd49c70ea4670bb7eb3e2f14f17428fa9328200bd51
- MD5 02acce9239e5805169b4c5d181d8c9a5
- SHA1 0020fdfacfa745589818382052aee3818eedfeee
- SHA512 41539b9319f8ef41726bc4b2912473c0a4e175978b61643740107a00710fb678b9a5f06fffbb2b70b1b9e9b69b20290afabfe1bed43f16d111918a7e19fff46a
- SSDEEP 384:Bw1/0agyXbuThIYi6yRrglAM+o/8E9VF0NycJgPy:S0agyXqT2Yi6y6lAMxkEe4
- TLSH T15F13A4B157E44918F7B73F3069B5096D0A777C8199F0F35D2280A0398970B41AABEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_en.dll
- Size 42KB
- SHA256 784e8a03c6f5df231a08e0671ddd66c554a68be2b14224521e72d8c50076d7a5
- MD5 1feaa8ae6b558b8fd45f566cd5e6272b
- SHA1 8284338c519adaf91fec6ce69bad2bfe34bc3c8d
- SHA512 ab5009663e5e59b8c7f7341b4970a39749c7f419c15423fd0d2686be518dfdf07578acde86207ab4da204f4d82898be164d3b6d5a1020ef7440f67452ca19d3f
- SSDEEP 384:E91FagyMeRTmIYi6yHksAM+o/8E9VF0Nyp+VQs:eFagyMeT7Yi6yEsAMxkEiV
- TLSH T1411396B157E44918F7B77B3079B4592D0A777C8199F0F3592280A0398970B41AABEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_es-419.dll
- Size 43KB
- SHA256 f824300af9088e1ad03c07e3f5c2c24ccfdbfae552f134d2cd1314e2c6842375
- MD5 7fc614569f8a00c7f6c105dc308a05bb
- SHA1 e48f2cc5f8a647d82ffbd604f802b585dd9bd51e
- SHA512 efc5c114d5a26d4444b5a9b67d03c5b62e8fc376ccfa16f73773d1b738b38f12e20cf1dc891df3898b039356196e130f432aa69aa166b9e0bab9be1e3b1f1534
- SSDEEP 384:1hTffy4xZIYi6ynoUcwAM+o/8E9VF0Nym2OH:zTffy4xOYi6ynewAMxkEkH
- TLSH T1FF13977046E85A49F7B77F34A8B4192D4D67BC8198F4B34D1240A1398970B41EABEF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_es.dll
- Size 45KB
- SHA256 915a8b251b22157119abb16748907f2866e51b71a0ad13c0b3c52f3a8ae5a489
- MD5 2e147e4e176468a9a242598a6bdf1e20
- SHA1 80db4da2da23f71210fdeb34b437d538f4721078
- SHA512 4edc4632d4556bd34c254497a754f1cc33ab63e081ff420c4384e4e84d4f5c9730f00349517f682b77074953ca314d296248a1af4bd102265ae1d841017c505f
- SSDEEP 384:RYClNRaLElvwIYi6yPtH+AM+o/8E9VF0Ny2ey:aClN2ElvZYi6y1H+AMxkEm
- TLSH T13223843156E85A0AF7B77B34A874193D4E3BBCC198B8B34D124061798970B41AE6DF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_et.dll
- Size 42KB
- SHA256 02943198f3d5f8d335681c2f234e28bd625a4344d580726e6832ebb917a8c564
- MD5 0495217e97c7f9584f1a949e52ab6719
- SHA1 89632cb99cac75aa6e0ba2c97eb6fbd7fed2c53a
- SHA512 fdc46d8f0c6523706d5836ae085dbf1e6d490de3c9104d1b19bd5bf6ef0610a8c5edbfb30a669a9bcb1c587e945d25a1d4d6233ad56dae5920cb66baba189513
- SSDEEP 384:7AKrbDFbDuVEbJRzSQn1IYi6yPL4AM+o/8E9VF0NyXEIJ:MS9umDnnCYi6yD4AMxkER
- TLSH T1A81396B156E49918E7F77E3078B44A6D0A637DD299F0F34D128060389970741EABEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fa.dll
- Size 42KB
- SHA256 793e4facbdd8aaee208ce16960c20497ce5b73c3fcc8ae685e1d2d9a6c9df857
- MD5 b7c188cc894700632f0abbdc14d05118
- SHA1 06054e584dc48723cc1c3df4d12b44c714068f85
- SHA512 17e6184548e533bb10f6d78912c77e8e9b555b0ec91417879154fada0bad515b6d6bb6cd4d0569818da02a8cb7311fe1be343c5245991a3f942aee8a53129156
- SSDEEP 384:KPOiiZbXQ54tIYi6y8WBAM+o/8E9VF0NyIf6:qZ46Yi6ydBAMxkEh
- TLSH T15B1330354896CC38E7677A34D44BCC3F216365D998C0B77216D4643C8AB03A9AB9FD2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fi.dll
- Size 43KB
- SHA256 4ee8c1fcf9c8cec7650503bce686f297baec74675001c1d9143be2ee5106b14d
- MD5 c943b9809dfaf64374b6b0df35a6fb6c
- SHA1 579dd6771c37a2dfaee6ecdea8fe0ec045e68152
- SHA512 abe33f629a00ff4ae8639f73c5fed250674530fbca96dfdbec8d843bacf2a23ebcf5b663ade641c0ed7b819c2933caca27749e6f5855e5cc8f72b63343e24730
- SSDEEP 384:fu9gRfEUPhXY7RTYXU9hKh9GAHgIYi6yPyuz9AM+o/8E9VF0NyeNnK:fakfEomQjHpYi6yKuz9AMxkEcnK
- TLSH T19813767102E88928E7B77F3069B44A2D46237ED269F4F35E1A4061388931741E97EF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fil.dll
- Size 44KB
- SHA256 34f796d2747881b015c276e732a56dde1ca0391a92e6056fa3ba035079ea89a4
- MD5 123225552b7e78596df8bc4c1bc4e061
- SHA1 f685678593546573f92b1cca29f7a4b0beaa515e
- SHA512 d66ca5004e69dec64574d735dae2ab3aba39a135c4e6836fd0f235fb756c8feebe4b3e596c2538201c37b75d930c076d798edddd3abe352ccd3778e4d4912a2c
- SSDEEP 384:nrjaUrPer+B3Rlaw7yNhIYi6ylE3AM+o/8E9VF0NyU7IPa:rjaU7c+B3RlawWN2Yi6yQAMxkE4IPa
- TLSH T16C13A87156A8490CFBFB7B3069A4196D0677FC8299F4B745228061389931381EFADF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_fr.dll
- Size 44KB
- SHA256 4591262991f9987ae96536b810c581620519aaebe019a1ff59449bcd7a48c93d
- MD5 7a14ae39e800dabbd68d06a8342b8648
- SHA1 cb4690182796eaab35939ab170b68fbe08004bc9
- SHA512 f1e0c261e4bf057bd1760841ca58dc3c5965c299d404eafaa06482d745b0fe0754f19b5bb34752636e66321b1f5769f5f13b624a246c9384c4dd740a214d9071
- SSDEEP 384:lK398EoMcpW4xwSIYi6yyf29GAM+o/8E9VF0NyuV:o3aMcNw/Yi6yF9GAMxkEM
- TLSH T16223887153E45909F7B73B30B879492D0E677D8699B0F35D1280A07C9930B41AAADF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_gu.dll
- Size 44KB
- SHA256 88ab42e9ca190892538b32edc92ad9e71ea0c9e8eee8d7d9648aa346034c258d
- MD5 5832a382e0fc97ef6077044ac2f0c9b1
- SHA1 56d5c1b61a1c8e8baaaac5f48711db31c4dcbb4e
- SHA512 25030159432f35c00c44553ceffd70997744215a5d8a76335d1b0a0b6b918852615ebd321a3552cbdf8bfc575920e9d232e1fe4219fc38cf0665bdc3a146fbbe
- SSDEEP 384:lQt3UrpgV4DkYCQsfwDkIfdIYi6yGcQAM+o/8E9VF0Nytyq:6tUrpboufKYi6ykAMxkE
- TLSH T1F2231E391A1B5C8FE31AB930B5A4593E43271880C7E0F343119962799EF1313BA6EF6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hi.dll
- Size 43KB
- SHA256 005bcc8cb546db64daea5e83efa339d5b6248ffdc423de245e1ea1ad0a99e82a
- MD5 949823f9d28c169ed117aa008322726c
- SHA1 da53a482cc5ba3553943dc2fc58ea77dd7b4e820
- SHA512 2e77a0048c4c2d6c475962031493a63106d18a6fd8a92f9e02faa8be7c73aa518850a55dc9e536179e7c185e7a0ad3896cbb3b5c6d71c173091ca78ae8a9914a
- SSDEEP 384:zWMTM6Ac6AbEcXwwEx9IYi6yxoB6AM+o/8E9VF0NyR2O:z7TM6Ac6AbEcXwwOqYi6yfAMxkE2O
- TLSH T1CE135F3204404E2CE35CBE78F4640ABF5DEB6495A5CD338266C071B4D9F533A668EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hr.dll
- Size 43KB
- SHA256 f42d2cca2bf323a80c1998189373d6cf3f57d14a4e311a7e89018b9134e86287
- MD5 d97fb038ff65b4be4ee32ec3dd913226
- SHA1 f6a7dad37a92ee37f63189a81a9463a193da2e85
- SHA512 040e512825092371fb2dcc58e5ea1c7fb7b7d769e5f26d3259e2df56b80586c5155441572508876ef201ee392b1518ffcbc940bcf4a640ad493b3366430caa57
- SSDEEP 384:+xbNNeXz1J2zMB5qBL/v7IYi6y+uToMAM+o/8E9VF0Ny1t:ib+5IL/vEYi6yfjAMxkEB
- TLSH T15513DE3196F81919F7F77E3064741B3D097B78A2A9F4B34E118061788A70741AAADF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_hu.dll
- Size 43KB
- SHA256 48cf6d5c45714bb4f08d80ec6fb871b7cc7bf44cf49a4daf858b429225c2299c
- MD5 d2be427ba68d1e3c6f23f0f7542671f8
- SHA1 6abcfd568d45cf7a286d6c679e2a08617a3783de
- SHA512 6fefafb51346a3995c6aaecd14d6deac5bdf774c62987165d8d7ecfb0b76555e661d4df9b2fa50811ff941329a18d5e99691867beaf9f3c1c634470ede0770a8
- SSDEEP 768:xy7U7oPX1C2TycfBwGFTbeSNp6931lBVZpOAy3FGVsLwYi6yf27bAMxkE:xy7U7e1C2TzpwGFTbnp6d1lBVZ8Ay3Fb
- TLSH T16113D03152E84909F7B77F313DB44A6E0A27B8A059F8F35E5180A17C8931741EA6DF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_id.dll
- Size 42KB
- SHA256 a9012188e55a3379e3afff70c5496f5cdd75835a003f180065793872e2f517ed
- MD5 fab8cc2d4e39962bd0b2b8072a12f6bf
- SHA1 6dbded4d8098ec47a776fcb3079d774043a42fd8
- SHA512 882d1d261e8db764f1bb0d53e17d6a54ab8fa82a4d97734dacc9748598ae213cf1ae3f4dc60611814dc74372c77bb07e2cb0fdbeec543c1ea46f9e3edf9043fb
- SSDEEP 384:9CQY5juSkAHqQ3lbZe2E9RyrUx/IYi6y5tCAM+o/8E9VF0NyUPNk:9LZARwxAYi6yTCAMxkEay
- TLSH T15713CCB152D8590CFBB77B3065B4196D0A67FD82ADF0B359228061388D70781AE6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_is.dll
- Size 42KB
- SHA256 c42768fb9dd2f67161fd03fb7c6066a58a37db58d568e92e166fb9de77be5cd2
- MD5 f317776a4cd6f5634a889767860b8981
- SHA1 d5c25756bd0a6d1bce005f4c449b4efd02a2d0a3
- SHA512 8c8238b714c63ae648fc47f1986f18b6553b99711cdb89f9490d173fb8ef7038c9f38308c789ea57a8ba4281b21e564ad8e9412fe2faa240e926a309d4d6cc80
- SSDEEP 768:fL6iBA06DkU3QF5EefV3oNYi6y5AMxkE2i:fL6iBA06DkU3ubfVW7pxii
- TLSH T11713DA709398580CFBB77B3024F55A2E4A27BDC29CF4F7491185A5388931381AAADF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_it.dll
- Size 44KB
- SHA256 f93fd977be4730721623fd1b1845e321ac23c8b8e80ce85c982613e1accb9d76
- MD5 b6641153a2d527d485bc6bbde699b8d0
- SHA1 6f82b52fae48440b1f18a5385b185794951b106b
- SHA512 04f8debdd211ec536d1d5c9cbe39f96bc99caa8a1d2e5e6a669167bf60d1f2c02c3b7bc82a40e377cddebcdad89cdbbe8826d919fbba8f8d35ac3aa2f77eebd4
- SSDEEP 384:uD+GrIn+sdB3LMIYi6yQROPCAM+o/8E9VF0NyWX2:RKIn+m3LdYi6yEaCAMxkEoG
- TLSH T15C23627156F85A08F7F73B34A8785A2D0977BD8198B4F3591281607C8930B11AAADF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_iw.dll
- Size 40KB
- SHA256 f9a67f92ae9b42dded0e50a002e578e34d96f1cde5e478f58634549dfcc660c6
- MD5 02d3b7b940712eb3516507cac2c045e0
- SHA1 f4201ad7d882d1efeb9d4b928ea290e1ac81158b
- SHA512 32765c66c6d26c171a32a82dec57b54e3ca0e28229b2e3b3b4626e3a33a5bf0e07fcb46f7ab8d03c341a0e79a6f0096630b5e734cbf8cbe876b25e8a64a0fe91
- SSDEEP 384:siQv7kdVe4DyCc53iKR6GIYi6yclAM+o/8E9VF0Ny2r:HYSqR6bYi6yAAMxkE
- TLSH T17E1350310650CDDCEB16FE32A15E0D3E5663EAC055E473532098A470AAB8752EB9EF7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ja.dll
- Size 39KB
- SHA256 d567fbcd8f5a7bfb827966ceafc7d3dd97e2800672e7de656a88a0b034152847
- MD5 c4406f04dd466c41c8304a25d1ea11c6
- SHA1 55579fae6cd7362b505c553f3b2bf06494fd6a66
- SHA512 91658b573ad279a1bf2d069570f8e85db92d176f3b912722c75865e267180f9b9c3c3023ebc04f0fe6b1cb95eb4395e2bd8fa646b32b249f7acd58efe95375eb
- SSDEEP 384:tGWvEXjOBWciHIYi6yu5AM+o/8E9VF0Nyq6MK:FvETOBWcioYi6yUAMxkENMK
- TLSH T16C03C4B166504C0EEBB27AB050946D3E1A67F4D156D1BB8221C0B039CA70746BB5FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_kn.dll
- Size 44KB
- SHA256 49ace637192ab8787f18dfdf04fee63e027056c43b48ec2130d26a7aa14c131b
- MD5 ad8eb8adfb943e71a75bc7d4710a21f0
- SHA1 33c753c6ebb8612392ba84fe6cf2eadc86ee9400
- SHA512 475742ddf3983945cd3b42ce21fdc431bc8643ad478947e4a49153a5cd2563698f839c95991b399b329d98501d0c13c9b3d6499a096b2c7512b2fee106676324
- SSDEEP 384:eZKOfWBBS4IJIYi6yRUnAM+o/8E9VF0Nyjjl:7Of2k4IeYi6yiAMxkE7
- TLSH T1E6233079427A9C0AE7C5BAFF7092193D9113598353E0F3923184503C8A707766A6EFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ko.dll
- Size 38KB
- SHA256 f4e48477f214e51db6da1a3fe412d454997728d2f831909f192d57d7256f6962
- MD5 c5c052ab089dbb7c8ea0507150445cf8
- SHA1 808620bff66334b10eb287e0adcd1889ef046d70
- SHA512 8fba2f9484e3203a45932c72761ce56e7d19d613b5d8e8d033e07b7c170050e41f3a5455bfc90b31fba6b5a6fc7db91030050ccafbf2f2f8a43aecfd5152ce4e
- SSDEEP 384:GpuEzd3IY+N1vZ0YoRHgA12slxB4xR0kTY1M5tkOoMIYi6y/92sAM+o/8E9VF0NR:OuEVmAaPjvodYi6yjAMxkE
- TLSH T19903B4324564DC1EDB12BA3164D54F7E926361C14AD2B392A2C0F178DA70381BB6FFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_lt.dll
- Size 42KB
- SHA256 b7b9929da674b6cea97055777c1d5bd952cc24bd60f626d942275baa394c6779
- MD5 699adf1a933d5e0257de2cdc5984c289
- SHA1 d5b50aa4aeeb2cde74fdcb2ea4a6a91754699d2a
- SHA512 df5cc06916bab486d354d4d0d207ada10a588af2af0a43df8352547ea33b389b256a17ee311c3042d09f3ca3f1cf74e29ef74224f0cb4169946b2084d2c442ca
- SSDEEP 384:QwN3nc9eHz03T0R8C923FaIYi6yRYXAM+o/8E9VF0NyY:JpckHz03T0R8C98nYi6y6AMxkE
- TLSH T11B13EC7152F8494DF3F37E3051B44E2E4677B89159F0B30A21906179C970B81AABEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_lv.dll
- Size 43KB
- SHA256 a46cf6a2118112f62262dabc2c156dadc6a2d3d224e6f935f57a352a7c173ebf
- MD5 e8cde2466986dba8ecfe835878d3dae6
- SHA1 9a7806e4dc96604a97921ffd560f14c25473771f
- SHA512 1363dc5d4e4360ee683bcb283b16a23f265e35ee25ac3c8039a43b7df8e7c562babb2b531ba1456825aa5e2235bc14510bf4b1fbdafbd90f2a0da8e2ed705902
- SSDEEP 384:m835yQOea2euRIYi6y8FAM+o/8E9VF0NyRO5:TnCuGYi6yqAMxkEe5
- TLSH T1C213C87152A8191DF3F37E3065B44A2E1A6B78915DF0F34F1180A1798A70B41EABDF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ml.dll
- Size 46KB
- SHA256 6378351e9dfb25648249269aba52885a55fb8dd7f759800e9f56691a61332450
- MD5 6637710aa98d7f8d35edc1ab7564882a
- SHA1 b33c9c9fdd26ae38f164d9297c1f1ea7ed6817dc
- SHA512 891881c13e5dbacd54fae2e7464f37c5c35941551608580b08995396be737b4b787e99a712139c0b74445372055fb0006d847fe87ead704c76a29406647af7fe
- SSDEEP 384:AvEBJvfZigR8/JLp7IYi6yTiLSAM+o/8E9VF0NydlB:uCoJLpEYi6y8SAMxkEb
- TLSH T11F2330361118ED4BEB9DB57079850D2F819B1E8E87E4F390219060B97D3A3036E6DFAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_mr.dll
- Size 44KB
- SHA256 7bc2a4f429fa0776f05859086d8c836ff07573abd7c8e2db0b5461a03677e432
- MD5 492e2bef61a4838b819afa275ec71a66
- SHA1 27027469a9227d2d53b3dbe746f21d8636934e2c
- SHA512 fd464d9e2c228b2586e14f57598e24b455f855c4d91ae1d2fe4f31e2e03e1f2d1d80cb64c051a849d931e71c4e2d99f5fedb8853e70ab73411980ed236e21225
- SSDEEP 384:2sJydCT73y7OiAEgYIYi6yLlmAM+o/8E9VF0Nyk9:VJICT73y7DTgBYi6yZmAMxkE
- TLSH T132131F3901485D1AE35DBAB0B464197F0DD7288067DCB3811AC4B1BCDDB43376A9EE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ms.dll
- Size 42KB
- SHA256 d20e8b0e8850e1cbf534d88bb7ded5d3c8dfe6d420f5280e92e461416b029196
- MD5 1d791ea4e0b6bb78d19f011dbe1a2610
- SHA1 c64bd9174848bcb80225906743bc8920764a74d6
- SHA512 1ccf5065b26e9512a1b8869d1d9cbf0a25a4c1d0c8864bf2c6d2ac9c4a7eb59d45728a81fc61a66da9172963622ca5ef6e3c1bb236edc0879034eb036b0c3497
- SSDEEP 384:c+vvIFCrRLtUv6odpayK/YjfZ/fbMwTRlREFNIYi6yPaXbAM+o/8E9VF0NyWRW4/:VShf3TF8aYi6yybAMxkEg/
- TLSH T145139AB152D8980CFBB77B3065B41A6D0A67BD82A9F4B35D124061388D707C1AE6EF3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_nl.dll
- Size 44KB
- SHA256 9edc329d8e25eb02aac3fae70f4cc6428d711a98ddbfbad9b9775a983cafc24c
- MD5 8ab70f8657ddf4454d651a2165f8ec55
- SHA1 d27c2f64385bf7926dd7050ef36e18d58e224e51
- SHA512 7a79e228a30159b7015cd06f5e0819da2627ba52f956b62fcee59d108a9f7e2e6cae48085de92df633e89dad3015727d9e0a57d61142d6d478a6fdca12008e54
- SSDEEP 384:aEZTcrh3Ne1sIYi6yNG0AM+o/8E9VF0NyahJD:vZg/e19Yi6yxAMxkEw
- TLSH T1B413757152E8891DF7B73B3069B8492D4A77BCC1A9F0F35D128061788970741AAADF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_no.dll
- Size 43KB
- SHA256 57eb62301f61ed10af075d7c34e5da8aad1050d12307e1c5888dfd3593885e30
- MD5 48f72eebf8e913ed322b79fdfff57b35
- SHA1 f00598cd63ec2896d0494c33bebf1899d2faaa80
- SHA512 1def279e4a9e380298a1c27b33317b0f394e10a2b9d1e63e67bf920ae879a3934a66657eccc6cce9d6e19ab862dc60638aafb52b568c813b4e9b9eed7a8092ed
- SSDEEP 384:fi5JZSiyCSiym5VqeAYiTv4yywQPrIYi6yJSAM+o/8E9VF0Nyb8/ixY:g5VmYGAyBQPUYi6yAAMxkEui6
- TLSH T1D913617057E48919F7B23B3078B84A2D4967BCD1A9B0F30D128061788971381E6BEF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pl.dll
- Size 43KB
- SHA256 c8c9db14d1a57ed95d2f9eca9e416ee934f2458bc0e1da4ed5e8196d138fd951
- MD5 710c65dde6113525a834d61a7e6bd4ae
- SHA1 679b3bd0e684bf5a80cd0ae29c099bb4337e8bd1
- SHA512 5cc17073e52bffd64fabe25190ccc86a4e51f61767d51e27ac27984422b503cf1993b450debd8923b1d23cf25fdaf3b3b4aa9b7c390799092bdb3094a7b979d2
- SSDEEP 384:NE7n7KZHWCE1UuGp6ZCIYi6ymwAM+o/8E9VF0NyJ7sTFO:y/yLEGUZPYi6ydAMxkEYTI
- TLSH T1FF13EE71A6F80908E7F77F3065B41A7D4A777C91A9F0B38A224061788570781AA6DF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pt-BR.dll
- Size 43KB
- SHA256 afcda3a585654092f8b1e1fbd1dab5a31f05cc5f600ffbace630db1ed2675433
- MD5 225790c9039c8e926cca5488b15019e9
- SHA1 2c58792faa08d2aa123271dbe0f46c367dc5e336
- SHA512 98e2ffd85fd29b4a4abb1e3e063ecc47c638b3855aef2e8a33a4b508139dba8587f8ca0958057a0ab2cc034cfcf434c6b36504f402f717bfdb586a13e0f23852
- SSDEEP 384:X/8Nhcxr/vX88cIYi6yNABI9qAM+o/8E9VF0Nyr62:E7ms8NYi6yi6kAMxkEc2
- TLSH T17613A67186F84A08F7B77B356878192D49777991A8F4B349124061388D70B41EABEF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_pt-PT.dll
- Size 43KB
- SHA256 afed70229e4cb588e8b118eaeca6f934b4d827b71680b737d4ebbebf9ea0c4de
- MD5 beb9457d9606b1cdb8f8c0877c7323d8
- SHA1 9491f9d720b1c5bf5f0d1aa7e9febf4dc5ac5207
- SHA512 7416076701f13d5c48a08adfcb04173f2e804d25948d77090d02e07fa44087f9c9d142a0068f461304f58828af8ec16c56f35b9a9c893b675b722538ef8037cd
- SSDEEP 384:3OEvst7KKEx+1GGBm7IYi6yMNDAM+o/8E9VF0Ny81orJo:r8wxMGWmEYi6y+AMxkEnVo
- TLSH T15613967197F81A18FBB77E316874193E4977789198F4B34D1240A0389970B41EAAEF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ro.dll
- Size 43KB
- SHA256 37fbfb5f53f792db6ba8de64447f90dbb6e39e6b4e89be0a6ac8f0ed8d39b500
- MD5 c99bd3ae49126dfc588ce72c0ab7883e
- SHA1 3a8cc71c487fa9c88ba714dd7ea36cd68f7db896
- SHA512 49df6dca13528b973adbe0c02e63992db954b55aad46a5f784d04d4e969c71dd44d86a21a0590488d38cfe169c2bdea29d6c80a1dc2d7ef8686f52285cef96e1
- SSDEEP 768:1RUCRNND67qGGQdVqbrI1naEpXJgYi6yuoAMxkEP:1RQdVqPMa2g7m2xj
- TLSH T17313C97153E81918F7B77F307874193D0D6779A299F4F34E124060788A71B81AAAEF2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ru.dll
- Size 42KB
- SHA256 6091364cd0606ed58ca0a5a4a09e48106de3d5816f3612e76aa7ef1e73f15bbb
- MD5 d70ba525c0854fc294afcf6990cccc6a
- SHA1 2ec4e77a819d97f5fe53dd02c5dcf5862a5410ec
- SHA512 6f1b4c4d16629a03f71893bbeec7caa19d9ca8b4b21a4c365e3ff82367822f541d0a1a1edb8f387423b8dd5df2123cf890cba0964b4df109ecfdacd7e289a6df
- SSDEEP 384:I7uFA4ZUvHlzo4d2ssIYi6y+7jAM+o/8E9VF0NyCkak:GVvHus9Yi6yGjAMxkEcY
- TLSH T160131D3BA5788908E715B2742A614DFE116777A027D5B3C2618FBC749074332772EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sk.dll
- Size 43KB
- SHA256 e0c329f879cfb011adfeb133da8fdf209b760126a562f05191fcb42705c66fdd
- MD5 ab8fae5d353f20cdbbd5f4d5827e9cc9
- SHA1 36bf4a0e5f0bebf7e8c5838f3cc84d80328b0790
- SHA512 a49fb6a9daa2ece709e8d52913e546acb0bf6938a0577e77ea6b371f05d8b00dc61f50404cd722edffb4bc94b7acf48c4fea7d5e57cec3aa82dc69a81bff573c
- SSDEEP 384:5VT4Uqha1iR6wLT6FIYi6yyVkLAM+o/8E9VF0Nyyg/:3TjgxRD6yYi6yeaAMxkE
- TLSH T138131E7152F8085AF7B77F3074B4493D0A7B78A1AAF4F34A5140A2748970781AA6DF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sl.dll
- Size 43KB
- SHA256 7da54573bff067cee9c9d274099778ac22fa5d9e4d0a06d8035fd1009937f8b5
- MD5 56706d7a652fd5eb9ae07b2817909f1c
- SHA1 c3a788780fb1fbda6003c8a842b57200c1a78180
- SHA512 bc2d305c1efea968ee68fffeb770e02e04da61a3f11687bcc4811bb540d30621daeb84a0673d93290b2a38edef44aa0167c10cb5700daaeaf9fc9d73e0c963e4
- SSDEEP 384:QYaTvshVyiWQZpdpWBdd1imIXous80KIYi6yMzj9AM+o/8E9VF0NyvH8:5mrQZpO14Zs8uYi6yMj9AMxkEq
- TLSH T12A13AB7152F8090DF7B77F3054B4096D0A3B79E1A9F4F30E119061B88971781AAAEF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sr.dll
- Size 43KB
- SHA256 b41344bce4db11f935d386c9d96427c8ab96fe2e489071579cc410f226fa50b4
- MD5 897c2e0db6e086c4948f05517489f529
- SHA1 f1a9c3102cc5888e4feeaa2ff2cb9e781d6806e4
- SHA512 6397c1280eae4fed3e307eb8b2b2abb399cf29f3b7f05c4ceb50e1dda0d83ca958808f9543904964c0eb9d5c159953e4fb6a80446b1f4429614faee575ff5f82
- SSDEEP 384:MbPlxgxLUjYFotGNqIYi6yvwnv6iAM+o/8E9VF0Ny1:2PGUjO4GNXYi6yYJAMxkE
- TLSH T18C13BA3F65B88908F741B6301AA489FE256B779067E47386618F7C749038732375EE8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sv.dll
- Size 43KB
- SHA256 a8d5a9a43e307781d6c97ce037c18334aad921466e023abd141aa78a1e3fbc4b
- MD5 1af9274ad0138bb8554c8de1a025bc1a
- SHA1 3ae92b25c76572099fdc92e958741a47ae160b6d
- SHA512 55cb0950a565a33e7296c20d9d1a73aa5352a25bc987db2c8e024f817bd29965e094f2be4e32baf953a571945d57a745ec6ffb9808f45d54bc7f69dff840a0f8
- SSDEEP 384:eJaxa77CEhE7kIYi6yh3XAM+o/8E9VF0Ny8oz5:2axaCEhE7VYi6ytAMxkE95
- TLSH T15613627157A8491CF7B37B3068B84A2D0967BCC159F4F3192240A5BC8970B41A6BEF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_sw.dll
- Size 44KB
- SHA256 5ef309a8fbb93e889cc68cdfe2fdb5b8355a08f4fa952720ed912e4bd01464ac
- MD5 428a4e2742aa371ad2e1666d4f9fc531
- SHA1 bf1d6cf6b80faab2cbb6036363851b3ebfbe24a4
- SHA512 d9f2fc4979ab7162f598e12aca329ef7d3c708530f9378fa8431c2fbdb8434cd607c68935f77f9885993fd22ae147cb2d4bfc8b646e11f51d718fdc5039132d1
- SSDEEP 384:DO0gicgiN7upv4MZ7YNIYi6ylZAM+o/8E9VF0NyOK:K0Qx72v4MZ7rYi6yLAMxkEl
- TLSH T1A023CA34555C5C0AF7F7BE3175E46A2D062379A26BF4F385108460388D307A2AABDF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ta.dll
- Size 45KB
- SHA256 bfff56ab5e43e209ca84e647417d74f438d9458a310d5e8eaf12f94ea1fe0797
- MD5 facb8f2aa423e3857b761cacd77e83e5
- SHA1 2af6fabbdc0b7b271deedc7da8999ef917873ce5
- SHA512 c117b87f27fb4a7a7363e5c514b87eafa561477bb32eb9b39140f9cf2ca7a8c01b92563ec19fc44633af5b006ae526b7acbf6a695d5ddeaf6a50b33334e718fb
- SSDEEP 384:Xn9w8Y51ZLmE4r2pZIYi6yEINAM+o/8E9VF0NyTATb:X9vY51ZLmE4r2pOYi6yjNAMxkEpA
- TLSH T14F23213C0A2BBC0AEB15B9327969583E01172C8197E1F3B11199643CCAF8F22766DF5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_te.dll
- Size 44KB
- SHA256 1da62793361b7186f11c5558b6224e20bccdddbb9ce50a46aac59038fafe5503
- MD5 d514ae1d1448b689307787de873b19df
- SHA1 9b7a30ccb3548338c750e89b9459e6277f45c426
- SHA512 ba3664887eee6ce8ffe27eeb3e7a1ba60461fcda1b4a2991ed501f04fa03338c04a205b9986627c4eb0fa37e1e16df95c55a19acd18f86c535623164990b7629
- SSDEEP 384:rUAEeo45Z49fN1XnWVIYi6yNgAM+o/8E9VF0NyTlHh:REeV5yFXXnWiYi6yCAMxkETHh
- TLSH T1FF231D3809185C0AE3DDBAB074985E3D18A359C16FE0F76290C57038DE717276A9DEEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_th.dll
- Size 42KB
- SHA256 6a0eeef7b91422acbf8219a9aef8e7748c41372cc5af568beaa4e7f22f5360cf
- MD5 2872feb62b490b97e7b7d00b7b43883c
- SHA1 1886fedadc2caeb2f8b5f27f4cf0604365fd0262
- SHA512 175d20efaeb608d50c8f47e7072a40675bcb8422de8de6933b2e5568a3f82a2114f0028bb3a6a53e5266db5514e2068b47dee00d54627bb0bd92ab246598a070
- SSDEEP 384:p6NBZrrGsMKt8hetnOAIYi6yQoAAM+o/8E9VF0NyHU:WZrrGszt8hetnOJYi6yHAAMxkEq
- TLSH T1E6131D7481715E0AC70BB5B0E1D44E3F3C2B6581C8D6B391909AE934DA70722A7FED6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_tr.dll
- Size 43KB
- SHA256 4c810ca4900de1675cafcabda6ba0370c6cab6f724207ee9ce9bf38c79f9e019
- MD5 696027229b8aef639b28ff34e487e508
- SHA1 b06154a676c6fd93405744e0b439b2145abbc463
- SHA512 d1cb5bb35ee406bb35964238653be669dec50093fe448be0ba5071c247c0cb66709625dc6fd9a3112ef51d7235292c3bf0a37cae6497ba6c19df26a2b9349abe
- SSDEEP 768:1Ep9FRqnk6qXQEdmvgNPTEw+G9Ahrxe+BzQSXGwYi6y+6AMxkESS:1EtA6hdmvATEwSxrQKp7fxr
- TLSH T1C713EA3043D84D0AF7F33B7428B4592E0AA779E5B9F0B31F2191A13989707815A5EF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_uk.dll
- Size 43KB
- SHA256 aed549ed1e358be04e4f8281c76193a7bc611373523bedf843aad6aa258b4f99
- MD5 3aeebf29a707ca984ffbe85c9ae6dc39
- SHA1 afe35b0f23e6ebdf20596fc1845b8cee0f648a0b
- SHA512 e269bf4ca31f34467dad988d402813ac9f421872aeb061923434047ffdb9ca4dca5e391197e89cbfe8e6dd4a7d6dacb93e9c58c9f7483a641f0cb4155ef78cc6
- SSDEEP 384:73xwKgHxyC2secvVJE/GfuyKIYi6ykNYAM+o/8E9VF0NyOtt:bxwVuy3Yi6yYYAMxkEut
- TLSH T1AE13C53BA5788918E709B27119968DEF1067B79017D4B3C5628F7830A078332772EE9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_ur.dll
- Size 43KB
- SHA256 191c9e6db1e730c0ff34c55a67393360a8a217fefa1c8285d8187926bc5bcfa1
- MD5 690faf81cdeb805730c6cc807a70a20a
- SHA1 17a20fbd19c09bb8f2c9f7aaf19c96a712570572
- SHA512 a647eab845bbb80b7664082be7cd8df31aa232db6abb01efd9668c66adebbeca2f84e117ebd85a0b3abab818be6bf9b1edbbbec396d4b3e29583010f009c748d
- SSDEEP 384:NvKq9zmAco2u9keeZyYGm7IYi6yG+AM+o/8E9VF0Ny6N:ZKq9zmAco2AkeesYNEYi6y7AMxkEq
- TLSH T1EB132E750428CC7CEB773A38D046D83F162361D555C1BB316ADD64388AB13E2AAAFD1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_vi.dll
- Size 42KB
- SHA256 25def11ba455b1b7bc55b07bc8c452a13671b177874ee9e1d5ce268f56c4f69a
- MD5 30957a5d98de4d6102c144c4876eb484
- SHA1 d5a89ae976dbbb300ad867d7ef156e874170f7ba
- SHA512 faf513a0995426c844c453570e81a0dfbda970e1d6656ff7e12dee56b34a61710436ef1a4988702ace6e3eebc8b5f513ac6560d980c955f47e4249a76e8e4bc2
- SSDEEP 384:syonyXlJncByIYi6y4lAM+o/8E9VF0NyTOZiA:s3nyX3cBfYi6yWAMxkEFUx
- TLSH T107131A30C62B991DF76237301498193D096BBDE191F6F3429286A6749A70B41AF4FF3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\GUM8E6C.tmp\goopdateres_zh-CN.dll
- Size 37KB
- SHA256 90be7aef638dbcf0dbe1fe4fed327b0ebdfadd7554a8156c8498c994f6e09f1d
- MD5 176b0e2f0ed85fb9a63aac7b865a51b6
- SHA1 3635c5d257854b1aa8393ab982ea04469465112b
- SHA512 5162645d1122195fb1b7c03419818029f21cbed2fc5929e5f04128d88e7a0a9fe867c8c8546f9581b6ebef323b61cdf532c0cdd8b99769f09b99949a3285a5b9
- SSDEEP 384:4Hq5s9AoB23IYi6ybvAM+o/8E9VF0NyN7atH:+9AoB24Yi6yTAMxkE0
- TLSH T12E03C47646644C0DEB26793060D95E3E8B77B6C119D0B38631D4B134CAB0702BBAFE6E
- MD5 SHA1 SHA512 SSDEEP TLSH