Analysis
- max time kernel
165s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe
- Size 2.7MB
- Sample260808-zh9gsavapd
- SHA256 e3a1e366063df9315eaca7e6c822f6318203554707c19fc1b3924f171ccf780c
- MD5 a338e5f8a33e985466cb1623d7bbe591
- SHA1 f57ff472ad0bbf30f504f00afc5d7125b0cfdd49
- SHA512 e2228ab70764163423478e9952d16b03ca6a462c6cb187ed8ea5a8091332a53e9bb1c30bcb66cae9f6a4f0d1790d140bae9e1da2b63ed9f01bcdf82af90df4ae
- SSDEEP 49152:46WhVIuuUrFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtThZs:4FVIExNi+2ru6J+yZ78IVG
- TLSH T13CD59E2EBD55C032D56201B05929CBABE22DAE35076204CBBFE8793DD9745C25B33B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2572 Setup.exe 5392 SophosSetup_Stage2.exe 5184 SophosACSenabledTest.exe - Drops file in Program Files directory 47 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl Setup.exe File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl Setup.exe File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe Setup.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SophosSetup_Stage2.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeBackupPrivilege 5392 SophosSetup_Stage2.exe Token: SeRestorePrivilege 5392 SophosSetup_Stage2.exe Token: SeBackupPrivilege 5392 SophosSetup_Stage2.exe Token: SeRestorePrivilege 5392 SophosSetup_Stage2.exe Token: SeSecurityPrivilege 5392 SophosSetup_Stage2.exe Token: SeTakeOwnershipPrivilege 5392 SophosSetup_Stage2.exe Token: SeLoadDriverPrivilege 5392 SophosSetup_Stage2.exe Token: SeDebugPrivilege 5392 SophosSetup_Stage2.exe Token: SeBackupPrivilege 5392 SophosSetup_Stage2.exe Token: SeRestorePrivilege 5392 SophosSetup_Stage2.exe Token: SeSecurityPrivilege 5392 SophosSetup_Stage2.exe Token: SeTakeOwnershipPrivilege 5392 SophosSetup_Stage2.exe Token: SeShutdownPrivilege 5392 SophosSetup_Stage2.exe Token: SeBackupPrivilege 5392 SophosSetup_Stage2.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4516 wrote to memory of 2572 4516 2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe 89 PID 2572 wrote to memory of 5392 2572 Setup.exe 90 PID 5392 wrote to memory of 5184 5392 SophosSetup_Stage2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\SophosSetup-684772361\Setup.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a338e5f8a33e985466cb1623d7bbe591_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe"C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe" --mgmtserver="mcs2-cloudstation-eu-central-1.prod.hydra.sophos.com" --telemserver="t1.sophosupd.com" --diagserver="installer1.sophosupd.com" --logfile="C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20260808_204437.log" --parentpid="2572" --products="all" --customertoken="8e16329f-78cf-4bcd-b5d9-58a452f6c1f9" --pipewritehandle="2136" --mcscustomerid="75e32911-dcb4-842b-5bbf-bcf18b52cc7c" --userid="62fb46a941551b0fda453a7d"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Program Files (x86)\Sophos\CloudInstaller\SophosACSenabledTest.exe"C:\Program Files (x86)\Sophos\CloudInstaller\SophosACSenabledTest.exe"4⤵
- Executes dropped EXE
PID:5184
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl
- Size 525B
- SHA256 3484fe4376803d32c56ba6a850d330651be49e4b69e4de901b2100a80c25d9b9
- MD5 48ad0fbb2e473628ca6fbe5f40c1b335
- SHA1 4faab71eaea67497af28a8c1fe59e783a431752f
- SHA512 dca8268bb18f3219dbde371f59e6cbf5c622fedbc8ca450c433b03b2c1d87dd599da1c7bcd022ffbf6ac4d0d75b779603874ee1abd594a145214d05642f65f9d
- TLSH T183F0C0F30A79339416D8BB12838CEE6DBD32E665584D960BDE64CE82D4817F05190558
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt
- Size 1KB
- SHA256 653e1a599023b1eb88ab96137238d978529a070b828dd3309800bd131d8ffaf3
- MD5 9608edf834fe19c2bf34cc00f954eca5
- SHA1 2277ed5594d385b4fdb3f532e3a48394c1c6f1a2
- SHA512 a1cfefa8f12f54ab1d1b9e67e0893f2f4cc85bcfbcf9deac8f3eaef699bf336c11fead3ceb0e37453f3b5d7108134870c62494405349de4b0661725f5e0e8293
- TLSH T1092111366FF971023EBD9600B398E91C5E31595430585C4F787CCEE69CC276124D4B6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl
- Size 475B
- SHA256 de2c59c12a1774610b6c0952ade122028f892dc14bc6b568a44b2220897320d7
- MD5 4512cddf97293ca04baff2337da700b6
- SHA1 84d37d4cf345d38182ddf54c928b7d981c75faed
- SHA512 eb90655188ed2cbd8bfad3cc901c6a0b51cab84ac82201d87a8611366d61d12d96fea3a5ac1e4ec9f048906bb72dc16f1ab19ee1eaafe962c547458f57157bf9
- TLSH T104F00E316AB9380028C9AD30975DDC0C5C31F610B808607E6AACC8E495853A0629062C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt
- Size 1KB
- SHA256 92e6ccbe80f31db683e4c331b599efc91e593365af8895504a9360c087060d44
- MD5 450b9d35c9a0b33f80d9e8faa29a260a
- SHA1 1f20ecb65ac24cb20512c9c4983dcd9bd0d05b6c
- SHA512 4baa881f16f4acc75d71f79c36c503ab6e3008574e2dbd3714001cc217f72d0b430f651ac2b99cf5382b9d3f7eb625767a2820d62bcc3f00fff515425b6dfce0
- TLSH T1D62111134EF7340175FCE590B3C4CD2AADB1625C2A052D6EAC3CCAA79E50330199C1BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl
- Size 738B
- SHA256 d1fd764f8a1bbf5fceba137f1b09eb6b76ec8f868c60b176db43ecc0d40d2797
- MD5 9dec7dba2a6449fa5457740fbef79d01
- SHA1 a8e7da73b454e2cb3031d8b45df4748541f56cdd
- SHA512 fa91a1e75ce9ad1860f787e54a20c719498706eeca11d9fb14d5095c6b88be64afe836a772ce6bfd739a5c1ea385c353fc99704d5c82cb51c1b90c5e857d0c27
- TLSH T1D001B52A3E08B0022D790E2C7388EF802C32A3C82D028B1F80BCD6CB949F374911C1CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt
- Size 1KB
- SHA256 ab9dc99032c498691a788817d5af925ef0580f32904defe58b7a52d971d8bec4
- MD5 608b95a5138684796fe2b57ad00dac03
- SHA1 0a2996f1d26f0e9e3a90c333dc7acc3830d3b365
- SHA512 978c8743174ebe5de00eea6f8d0a9b45d8cc834c0dcd3050dd24d7386f81f8270c50094de5468d529765ab2ba6484378ec89f8b1b8a954845890168a9284c0c5
- TLSH T1DB31C9572FCF30123DAA9F085FDDDE530C21AA0028B14D1A7A784C53AA782620898339
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl
- Size 738B
- SHA256 91a8b79af85e5a0d451e35ebb5214038777ad80421115e2d6b4f915fef1981a1
- MD5 4c6122725ca25070dc5352617795e105
- SHA1 2a3aad2fc6e231e3109ed00467a77c2de570450d
- SHA512 75ec1d542e175e95b2d5a43aa0a855432e54993568bd6e95a1223deab3849cc102733628845ec02c68104d654e083ac59266da97f93ef321131be929fd3a7e34
- TLSH T17A0165D70B1E3B90BC58AC544785EC09AD2AACC40CA2B59E12F4C49B8C41AC154D921A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt
- Size 1KB
- SHA256 4d44a6ba0ce8fc3771c6bc95d385aaa944aabdcd2d908d87ef5ca20418bf5d90
- MD5 150c183892de69bdcbea89e8f59ac9da
- SHA1 a368d1bdc8c44eee589320656200ef2bf597d69f
- SHA512 dbba7932d861b5dad1e2ed53a643c5d35baaf1460a58a10486de92b5c7d722a570af5fce631c0f96bf4f6d7f4c4de4e2980b0f34b0948bea9c7f0a15198eeb26
- TLSH T14F31A4338F4E30943DF49F426BC8EE060E90A65455C66CAE297788558E71BB43088B3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crl
- Size 538B
- SHA256 1e5bbba37fce10c210b47f976c1980e366e2cc2456f2f8d575c3226bc82c166f
- MD5 c358dfd5a0408001fa7be2bbb6cba7b0
- SHA1 48b50717f2c65cb77899dd5409a96d69a0fd888e
- SHA512 7995704f27e45d1431ae716625a5a887cf85995b108a222fcaebabb03d0dce24a448675af96ba664c9b897589432d27272567425c36200257c1e423244d3f5e2
- TLSH T1A4F0C0531F47F2426877FA52E7E357C6C501D085988A9C465C9208A3B9C09DBB28D4C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025ecc.crt
- Size 1KB
- SHA256 89fb6464ac6a0d507b7486922b35405b35f1d67844a2ac3662ba10cf3ecc7719
- MD5 0c3d972fecd78f696776d45ed59c392a
- SHA1 300d7d2da297f2f641e150ebb86cf3df589e8c70
- SHA512 b4703078c26015b9a728772ed057d16cfc54bb1e4181c4007949d60d5467eab5398f2041d95108b25a61ef9076f4653d83dff3260dbc97f6d3b2541fce07b96c
- TLSH T1E01135A7AF25F403389794337FB73BC81646D4549A49F4C86C062C32ECC56B3E035485
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crl
- Size 1KB
- SHA256 df876aff0675399c4a496c66ca67bf16fc808f9fd9f9d5194c7f623898371d2a
- MD5 c3c2cd850f17e5f8d8621076609a5a9b
- SHA1 eacc79e5dc10ad6627c00772696d4a1e51c8bed8
- SHA512 4df9d98cad2f739bd39231a7875ee148403bb15a91b5740c278d2bbdc120a0191d9be2ce3d5781cae5a5dc3637c383c7e6cf5dc7d1bca6006dc8f2b448fa9da2
- TLSH T1C121A7BBAEA071978816D2446CCA0EC19105A5284641E40148222C41E821FDBF0EC4C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\2025rsa.crt
- Size 2KB
- SHA256 4ff561d6a910eea25e2c15d8b0139485680e1730c922ceb0fdf51a76e808b359
- MD5 acef53d4645e4c018481f57a04cb2f8b
- SHA1 5a7e2584c0728e82182f5e8a7294f0ae695c1b25
- SHA512 bf41b8d1ea65054566230ef3a0b7dfd04b8397e4594a81a8b5796bcbdadd973b0b090f6f1f6be67ce1435b57c21249b4babc4d669c7a35f98d84411e8f833bee
- TLSH T166413CD7EF65B3412C7BDAC8B1CE3134999479EB2DD852FE705220268420C31623DC4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl
- Size 1KB
- SHA256 865c9e89a44090820ac85ef791428b807e023ae7ccd23aeeff7e3e98fe552ea5
- MD5 ee71956f99740a9e15bbbd4e71b76f2f
- SHA1 2f848ca3ad9d0345ca9c08748a8f4f457ace08ad
- SHA512 5d0393fef86ba0188b63842c37dc71adbdf71b87dbb29d41dcc68648272bf51f1c2f4054106fb33b2033ac4c6859bb2d3372aa33e61cf1eb547961d9886ae9e8
- TLSH T1CB11B6D38F9074CA3127C480AC0A08F7AB12404B87F5D418575AF29247DABE89C1D9CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt
- Size 2KB
- SHA256 a034c29f8b46a303216f9e3a52aafbdedb864dede8cf632df05fd6d10e381fdb
- MD5 75a97f3f179ccc3a1b8617b6938b38a2
- SHA1 9f6c3e0a399e9ff5ad70a85ae6310a2a2367119e
- SHA512 5488c0440716d37ea4dda10fad6ed4ce21d613c7aec9588741aa8740e2440e3f7ef1b6cd49de851b38153effe8943c8743aff8f57dcede25870528b7ab550250
- TLSH T1E6413CD1CD50FCB76F239CC4E6CF016C4523110B3ED6F85100A7288905F978D25F4495
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll
- Size 2.0MB
- SHA256 e172d4906871135bc0f3a691d77e36f26dafa749bbea58b9b0f719bb9873cbbb
- MD5 d423bba8a9e44fdfdca1cbb1697f6e63
- SHA1 1116264f21ae4cb9dd4292de0bdf2e20c4a8f10d
- SHA512 de4bc0b8fc5e1e383442693a648dad938929b0a93271edeef24bd5727fa65ff8eed7dac712ec174fcea48a4fc7b8c98694b27bdbe6482125f7724815549d72cd
- SSDEEP 49152:Gn7O9HSgsvbd9gFvk9RvockPkOtd9o/+Nrwi:G7aQzWvootPkOtUS
- TLSH T14D959E22F545D033E08A01B2956DDFEE86BCA63107B114D7B3C8AFAD69256D36B31B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosACSenabledTest.exe
- Size 358KB
- SHA256 8c844446d9ec974e4ae419af40b1c865e2e7fa61917390578fce5b2e534d6060
- MD5 8ab0c824b251fea3168b065c92b93268
- SHA1 5a403c72b0d09ca894843fb02133075bd42d8828
- SHA512 b8536cf9580c6cab41875e73214405216568b63ea9de270354f38aba0fced015a37b0b9d620a4cda621e1476a36073a84cf492d8633d7f8c81a0a09f99376123
- SSDEEP 6144:rzecsLuDyrUlKYOOAhhncXRNiF6VWZslQEtwTVCGY6HCrRxpqT3:PebwAhhcXRNiANwZCX6HGRxQ3
- TLSH T194748C1DBDA1C472D5A3093698B4DB27E93EBC210F6026C76F843EBED9316C15B36602
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe
- Size 4.5MB
- SHA256 89e9c53ee2a5a908638719820be3d3c47b524ba6a21f1ca0edf5320c384729a0
- MD5 48d058c11c23e51ace5f6a8696b58fd0
- SHA1 cb556cee8c1ed2bbff4be5285cc718dc62137a61
- SHA512 2055067f6e7b39e1c581481f16f714f432c0abe4dab64abf02460f8c2c6e26e59a46cc10116a557c7a279c85756e73a5f6707f2821bbdb2233abcfd741693b0e
- SSDEEP 98304:BnQYfZPEyCi88dzV35BRMi188ebTT3dI+ui:BQYfZP988dL/MY8xTtI+ui
- TLSH T195268C35B905C032E49203B15939DFABD65C9D350BA164C7ABE87A3EA5345C32B32F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat
- Size 2KB
- SHA256 af9ea706ef76bd22f7d54e3cd35be4aa08edb6d0a15e135f1a668cb690d15814
- MD5 2364f8b3e085a68889f0e36e8b05952b
- SHA1 0084cf5b53e55a634815e8200745112f0a508245
- SHA512 d50250d781e275c7e50f150266d1c2ce5f1bf0c47f030b53185058f0a331c889604d077f5eefa52a943ccd3e84ea61aa4b2b301abdc7b10e04ff57646dccf8de
- TLSH T162417651CADB6DE253F23395032FEF685712F84B2EC85D982BDA810B1601F045BD41D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat
- Size 12KB
- SHA256 f9e974a970775f77b79b2ca2de38311a2bf75935802187fac14e2884f714c5ec
- MD5 5a67de2fd1f337127d543e4660a271be
- SHA1 546d0f2f86530c80d6db11864b1f08c352564aa5
- SHA512 416b0c28babc2c03392832305e5db1b6a49d1da677d53cd651cbd1b4813ee50f20898cabc4047dccb1371705be38f21a18f4dc92ab34d16f2969fcec4f6996dc
- SSDEEP 384:T+71nbf58DA7JsJZicXqDiBxD+mz4Cu51Kfau0FVWLI:TY198DA7JsJLk6DNDU1KfapCLI
- TLSH T19542AF7A5F5138882C7B03CB958A60745D0E07AEDAF7F0891C6A7E639289FD52271894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32-legacy.exe
- Size 2.1MB
- SHA256 f566d405960a5411edad61607206e429a0d2af72ba122a0f9b4bb02eacd16df6
- MD5 aff724b229550a5cf970a821e6dc68c9
- SHA1 310b994a816731d2a5f19f4de7c8164e1c3f9108
- SHA512 6f68f7a0cd9efc819b1b5e9a526540574932c4420f0d5c93ed5fd5ea139345ad5cab7144b774db7ebc5c8734b2cb93b1d1cdbadf94393520374d19d78b797eab
- SSDEEP 49152:f2sc+iVj9Lwyyw+LLBzxKgIhPVbIReic6nWn:fsjVjBddh9I8
- TLSH T1E8A57B3A7D40C136E58201B1897C9FAFD6ADAE340B6124C76FD87A7DD9344C22B32A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64-legacy.exe
- Size 2.4MB
- SHA256 f3e81df82a283e20c1d5fd92d13ccf725c8a4d18292d659991938f2ef5e32127
- MD5 b1c71fb5b6f7b1594265809f9debd2d1
- SHA1 504405384f3ec6b2c922fcba6098249e24bf792c
- SHA512 c4c263fef71114105ca430bc89dd3920d738a08d3dfadc922535250d01d9728d46ed87da7ecf1713b2b2f37e415ce6e6a20521161dad8b4777037a98b5262aaf
- SSDEEP 49152:sgnLMqKqSISNYVIgWaQehEWBcFisc18lTw176PxbU58ykz:ZnmgYId+lTI6OQ
- TLSH T11FC57D2EAEA402E8D07AD1B9C9525507FBB27C0503616ADF0ED07676DF37AE05A3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20260808_204437.log
- Size 13KB
- SHA256 2e155fcf39eb8bbea4843784d95a1900010579f73f3fcdeab0512838d24c3d69
- MD5 4dba6d62b5f8a177f533abe874199177
- SHA1 4cfa497470c3173c7672635d23348a0b31625d93
- SHA512 d6684b49d8581f515040be41729dbcfd9fbcc8168a01799d364d80623f45899ccdbd26bb4f5e0bf7bc3f4bd4df2b2a6a53b45474bde815dbd94c4ec440ca0e4e
- SSDEEP 192:70MGH4Vpwhlybjn6eeDmMoUb2xUZj/kPqghWkkx:CH6bjfeloUK2Jl
- TLSH T11B529AD00DFE88977D77460E98982E1863577C5B6A8A71A2F3F43CA1071F0258EB5AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SophosSetup-684772361\Setup.exe
- Size 2.0MB
- SHA256 0ef0f06d47d3ffd379789e693f3c8341fbbab2fd761e665cc774df145ce51c45
- MD5 424b964e84a8555705778e3a366ed327
- SHA1 c3407fabe5b2177b49667555db29468c029a0614
- SHA512 a75ebacd7b6bd88c77935f8940e22b93c3e5515303853d9819359f0a3cb2808a2d0c9bda0278c9b823c16708ccc12c2ae4ccf6413b49f2419d5d23ed1fb9c1e9
- SSDEEP 49152:yFxNp4+2oanSWdu6J+yWkWB3j2Q0eEnfwKGEDtTh/:GxNi+2ru6J+yZ78IV/
- TLSH T11DA57D2EBD55C032D96601B0592ACB9BE22CAE35076204CBBFF8793DD5B45C25B33B16
- MD5 SHA1 SHA512 SSDEEP TLSH