Malware Analysis Report

2024-09-22 06:30

Sample ID 230410-qqpb5shf52
Target PC Installer.exe
SHA256 f102a5b110551c066e9aed6b6666b13b81dd90065f8f3487ae4aa67edf3568f2
Tags
bazarbackdoor backdoor discovery persistence pyinstaller
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f102a5b110551c066e9aed6b6666b13b81dd90065f8f3487ae4aa67edf3568f2

Threat Level: Known bad

The file PC Installer.exe was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery persistence pyinstaller

BazarBackdoor

Bazar/Team9 Backdoor payload

Drops file in Drivers directory

Sets file execution options in registry

Loads dropped DLL

Executes dropped EXE

Checks installed software on the system

Drops file in Windows directory

Drops file in Program Files directory

Detects Pyinstaller

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies system certificate store

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-04-10 13:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-10 13:28

Reported

2023-04-10 13:31

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PC Installer.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\SophosEL.sys C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Windows\system32\drivers\SophosED.man C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Windows\system32\drivers\SophosED.sys C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SophosUninstall.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
N/A N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A
N/A N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A
N/A N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosSafestore.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosCleanup.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosEL.inf C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosED.sys C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosIntelixPackager.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosScanCoordinator.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\sof.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Sophos Endpoint Agent\SophosUninstall.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SEDService.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosEL.cat C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\scf.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files\Sophos\Sophos Endpoint Agent\deleter.dll C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SSPTelemetry.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\integrity.dat C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\scf.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Sophos Endpoint Agent\deleter.dll C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\NOTICE.txt C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SEDuninstall.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Sophos Endpoint Agent\integrity.dat C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosEL.sys C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\CoreCustomerAdapter.dll C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SUL.dll C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosArchiver.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files\Sophos\Endpoint Defense\public.pem C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosNA.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\sophtlib.dll C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SspEdr.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SEDTelemetry.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SophosFileSubmitter.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\public.pem C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SecurityProductInformation.ini C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File created C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\sof.dat C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
File opened for modification C:\Program Files (x86)\Sophos\AutoUpdate\SophosLaunchUpdate.exe C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\CoreEndpointAdapter.dll C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
File created C:\Program Files\Sophos\Endpoint Defense\SSPService.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ELAMBKUP\SophosEL.sys C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB}\ServiceParameters C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB} C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB}\AppId = "{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB}" C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB}\ = "Sophos AmsiUacProvider" C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\MuiCache C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB} C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1889EA68-C4C9-4667-B7BB-27E8C9AA9BBB}\LocalService = "Sophos Endpoint Defense Service" C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe N/A
Token: 35 N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3128 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\PC Installer.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe
PID 3128 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\PC Installer.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe
PID 3128 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\PC Installer.exe C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe
PID 4412 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe
PID 4412 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe
PID 4412 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe
PID 3160 wrote to memory of 4856 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 3160 wrote to memory of 4856 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 3160 wrote to memory of 4856 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 4856 wrote to memory of 2220 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe
PID 4856 wrote to memory of 2220 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe
PID 4856 wrote to memory of 2220 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe
PID 4856 wrote to memory of 2220 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe
PID 4856 wrote to memory of 2220 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe
PID 2220 wrote to memory of 2236 N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe
PID 2220 wrote to memory of 2236 N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe
PID 2220 wrote to memory of 2236 N/A C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe
PID 3160 wrote to memory of 4296 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe
PID 3160 wrote to memory of 4296 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe
PID 3160 wrote to memory of 376 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 3160 wrote to memory of 376 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 3160 wrote to memory of 376 N/A C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe
PID 376 wrote to memory of 3760 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe
PID 376 wrote to memory of 3760 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe
PID 376 wrote to memory of 1628 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\Windows\system32\lodctr.exe
PID 376 wrote to memory of 1628 N/A C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe C:\Windows\system32\lodctr.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PC Installer.exe

"C:\Users\Admin\AppData\Local\Temp\PC Installer.exe"

C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\PC Installer.exe"

C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe

"C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe" --mgmtserver="mcs2-cloudstation-eu-west-1.prod.hydra.sophos.com" --logfile="C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log" --parentpid="4412" --products="all" --customertoken="599e0e8c-da32-492e-8e84-2175ef3ba9f7" --pipewritehandle="2080" --mcscustomerid="dc9f39be-422a-5431-aa04-72a9b456fe31"

C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe

"C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe" --quiet

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe

avremovew.exe -f

C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe

"C:\Users\Admin\AppData\Local\Temp\SubmitTelem.exe"

C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe

"C:\Program Files (x86)\Sophos\CloudInstaller\su-setup64.exe" --quiet

C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe

"C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe" --quiet

C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe

"C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe" -installELAMCertInfo

C:\Windows\system32\lodctr.exe

C:\Windows\system32\lodctr.exe /m:C:\Windows\system32\drivers\SophosED.man

Network

Country Destination Domain Proto
US 192.229.221.95:80 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com udp
IE 108.129.9.98:443 dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com tcp
US 8.8.8.8:53 downloads.sophos.com udp
GB 23.44.233.160:443 downloads.sophos.com tcp
US 8.8.8.8:53 98.9.129.108.in-addr.arpa udp
US 8.8.8.8:53 160.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 133.17.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.155:443 assets.msn.com tcp
US 8.8.8.8:53 mcs2-cloudstation-eu-west-1.prod.hydra.sophos.com udp
IE 108.128.75.57:443 mcs2-cloudstation-eu-west-1.prod.hydra.sophos.com tcp
US 8.8.8.8:53 155.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 57.75.128.108.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 sus.sophosupd.com udp
IE 54.73.109.179:443 sus.sophosupd.com tcp
US 8.8.8.8:53 sdds3.sophosupd.com udp
GB 23.44.233.160:443 sdds3.sophosupd.com tcp
US 8.8.8.8:53 179.109.73.54.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 20.189.173.5:443 tcp
NL 88.221.25.155:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 8.8.8.8:53 62.13.109.52.in-addr.arpa udp
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 t1.sophosupd.com udp
NL 52.222.139.115:443 t1.sophosupd.com tcp
US 8.8.8.8:53 115.139.222.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe

MD5 10acf5a7df8c606018c125d6bd92a778
SHA1 ba50790477a90867873900079fcc25a6e7ebd263
SHA256 f43765fb7552bbf0ae3cb514d9cb53865cee99c45ebd9e82e0320fe275262afe
SHA512 96bcc6ffe566b71b1dfe59290e9c45c2cea6d0716052d4bd054fbd49961cb6d63e8ea896b9edd6dfd42b2bfec2ec12131f57beefd5a156f865e5d76823734132

C:\Users\Admin\AppData\Local\Temp\SophosSetup-1607087500\Setup.exe

MD5 10acf5a7df8c606018c125d6bd92a778
SHA1 ba50790477a90867873900079fcc25a6e7ebd263
SHA256 f43765fb7552bbf0ae3cb514d9cb53865cee99c45ebd9e82e0320fe275262afe
SHA512 96bcc6ffe566b71b1dfe59290e9c45c2cea6d0716052d4bd054fbd49961cb6d63e8ea896b9edd6dfd42b2bfec2ec12131f57beefd5a156f865e5d76823734132

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 f8839a15122fe33a24664dc526a9f17e
SHA1 b33b3140035b259267434fc4ef17c755abead33a
SHA256 30ac9b88dafb15fd75ef8384622a26956dc4a003ddb7cfdafa087cd144922a5d
SHA512 2a703d2c2fa914f0892e1ed3ad02a3e88ae74a9aa59b28b7e1e13b96c1251fdeb172c948378180a549dd8dcf3ae091d8963bea64efcb717c09e2cb63f3dc032c

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 564efd682910eb825e2622b9d571fca5
SHA1 5d2ec8229deb1e28e334a443c63fe0340abfce29
SHA256 65b5125e868727b62b325d26cac76749e400658b6adb2af49c163614e0be5363
SHA512 99fe6f04ffa403114ed0b910d641f8df8ce9d0180133ae4a3f2144db92380621f516b048a50b0feedece09bf2a6506d36b4e35c1e0c9c436a429badcca2906a5

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 d4bec5d6ac00b019375652f83204430b
SHA1 c0b827b5cb26e7d8d676ce0a0ecef9eb105bdd44
SHA256 fbfd94902b90c5388e62b15419ca8753c9ec7bdc8aadb26f0910ae6ac61de2f5
SHA512 e190cdd34eb27ab66fa598aebc5bfc4cc92d752b6574e87699daa6e3149513c70fef49333396cb651fd73143be2dec05d9554e80be1183e21b765ee18e2c0e77

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 046891e61439734f586e9f74aa5e1658
SHA1 f2249c1507d21249951a97553fdd249bd0e33851
SHA256 a41debe23b0ae1c64159a2e68ac5e4381e8eeecb3416999cbecbbe22756fa5d2
SHA512 76ff9511bdb864656a78557702de6a82bd4e221f123de1c5ef31fce1392214dd6a034d3d4596eac3285a6adefc3cfba44c3e551c8f2adfd79ca1039d9b8b5462

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\integrity.dat

MD5 a5c52e6516d01eba40f8d107b510f9a6
SHA1 6c99c4b2b8fd93e7fb62f9d1df167a25570ca78d
SHA256 affca98ebb36f3d35c69a5a34ca2c2c917db05e456698aa86feeff4251b0bc5d
SHA512 dd12505e530590f68f821dca1f0b87034877abc4bfd8454f6a0a85423c80831780e8c21776d0a3a8c4c5870ec1e77e1c8c6b98cb6f5201dd14bcaf515789bfe7

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl

MD5 48ad0fbb2e473628ca6fbe5f40c1b335
SHA1 4faab71eaea67497af28a8c1fe59e783a431752f
SHA256 3484fe4376803d32c56ba6a850d330651be49e4b69e4de901b2100a80c25d9b9
SHA512 dca8268bb18f3219dbde371f59e6cbf5c622fedbc8ca450c433b03b2c1d87dd599da1c7bcd022ffbf6ac4d0d75b779603874ee1abd594a145214d05642f65f9d

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt

MD5 450b9d35c9a0b33f80d9e8faa29a260a
SHA1 1f20ecb65ac24cb20512c9c4983dcd9bd0d05b6c
SHA256 92e6ccbe80f31db683e4c331b599efc91e593365af8895504a9360c087060d44
SHA512 4baa881f16f4acc75d71f79c36c503ab6e3008574e2dbd3714001cc217f72d0b430f651ac2b99cf5382b9d3f7eb625767a2820d62bcc3f00fff515425b6dfce0

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl

MD5 4512cddf97293ca04baff2337da700b6
SHA1 84d37d4cf345d38182ddf54c928b7d981c75faed
SHA256 de2c59c12a1774610b6c0952ade122028f892dc14bc6b568a44b2220897320d7
SHA512 eb90655188ed2cbd8bfad3cc901c6a0b51cab84ac82201d87a8611366d61d12d96fea3a5ac1e4ec9f048906bb72dc16f1ab19ee1eaafe962c547458f57157bf9

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt

MD5 9608edf834fe19c2bf34cc00f954eca5
SHA1 2277ed5594d385b4fdb3f532e3a48394c1c6f1a2
SHA256 653e1a599023b1eb88ab96137238d978529a070b828dd3309800bd131d8ffaf3
SHA512 a1cfefa8f12f54ab1d1b9e67e0893f2f4cc85bcfbcf9deac8f3eaef699bf336c11fead3ceb0e37453f3b5d7108134870c62494405349de4b0661725f5e0e8293

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt

MD5 150c183892de69bdcbea89e8f59ac9da
SHA1 a368d1bdc8c44eee589320656200ef2bf597d69f
SHA256 4d44a6ba0ce8fc3771c6bc95d385aaa944aabdcd2d908d87ef5ca20418bf5d90
SHA512 dbba7932d861b5dad1e2ed53a643c5d35baaf1460a58a10486de92b5c7d722a570af5fce631c0f96bf4f6d7f4c4de4e2980b0f34b0948bea9c7f0a15198eeb26

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl

MD5 4c6122725ca25070dc5352617795e105
SHA1 2a3aad2fc6e231e3109ed00467a77c2de570450d
SHA256 91a8b79af85e5a0d451e35ebb5214038777ad80421115e2d6b4f915fef1981a1
SHA512 75ec1d542e175e95b2d5a43aa0a855432e54993568bd6e95a1223deab3849cc102733628845ec02c68104d654e083ac59266da97f93ef321131be929fd3a7e34

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt

MD5 608b95a5138684796fe2b57ad00dac03
SHA1 0a2996f1d26f0e9e3a90c333dc7acc3830d3b365
SHA256 ab9dc99032c498691a788817d5af925ef0580f32904defe58b7a52d971d8bec4
SHA512 978c8743174ebe5de00eea6f8d0a9b45d8cc834c0dcd3050dd24d7386f81f8270c50094de5468d529765ab2ba6484378ec89f8b1b8a954845890168a9284c0c5

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\manifest.dat

MD5 df0988ed275c4499d8c80d6e920b70e8
SHA1 5f503057b7e4069c41707854219f7b3528858acb
SHA256 bd9dfcc61a988400dc7f32d0c5d682667389eac7c961a7b7c74cdad7111037bb
SHA512 dfe34b920fb6f55f2e3bdc26698e54089644b745c119af7f0b80b9190b96fe4a060785a200cc50de4530aaaf06c73a098b562d9a815700c6deadd8b33115a212

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl

MD5 9dec7dba2a6449fa5457740fbef79d01
SHA1 a8e7da73b454e2cb3031d8b45df4748541f56cdd
SHA256 d1fd764f8a1bbf5fceba137f1b09eb6b76ec8f868c60b176db43ecc0d40d2797
SHA512 fa91a1e75ce9ad1860f787e54a20c719498706eeca11d9fb14d5095c6b88be64afe836a772ce6bfd739a5c1ea385c353fc99704d5c82cb51c1b90c5e857d0c27

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca.crl

MD5 58a298e534a6774cb506e42eea00bbad
SHA1 45369afdfe2508ecfab66d68662bcf8aaf88486b
SHA256 671f4aae65c8fdc2e3d7f49a431adb36e24bd3c5c16e3d188763fd3f2c38028f
SHA512 c94c29e9b4f35a9fb004029b7f3f478e214ca65106bf5337c3ea17f38ec856245d340c3a74160730b2903a97b8512266fe57a5fd18c671b93e57a6aab156d75e

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca.crt

MD5 9a151a43293fc19eedffd2a105962370
SHA1 42d3d2f8db2d57e5ae6d5618e01077135b955065
SHA256 311e7160a6812c6d4b552eb7cd282eb72a8f082bec8b51179794ab979173187c
SHA512 de3dd102e3c5ae35ea7e5784ec174548a5ffca7766c3d27c5bb548d5e8dce2decfe70837c0d26b5fd4475e88e0f0c008315075c3c39702cf64fac9f77053cf21

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SUL.dll

MD5 6e60297b6a1bf208ec5a387cd3bbe7f5
SHA1 9a6335c5f02da6dc42d3b6fd2a24fc513ee61409
SHA256 6486302a2f5e767028be8176e68ff68223c46a053ece365f9059299668ceae33
SHA512 0c5d8eb77cb4389b9b85ea80cb0ab3e0b87c36fda004f84d70f2d8163a8060cd146aa1128fe11b71c4890dc8a6ac53d66c5b251e8e3e216f89a3cc32f32426bb

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe

MD5 c6688587690d21093dbe18bede41e0b5
SHA1 86c7998f2f98907bc11ef1c99e899149f896079b
SHA256 cb6fedb6505a89068e4d8ef17f8ca91b201bd5fee1b9ab506d381dbcf59dc732
SHA512 068880a090a5918e2059e4c49bd81e43b8235b7a623798cffedb0a208d708952d8b953c45ca912b59ff7e3263f1e41ac4ce87db188e55a60edcc9d0009453480

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe

MD5 bb9ab5d510e4905307cc7e39c07210fd
SHA1 cc9299ec2e106d0b9becacbe4db6df86a1b4d795
SHA256 55fe9913d6187ca9d6734c5e41dbed6ad3d3631b878875f8b5905ad2107829d0
SHA512 c3cfb1c1147ce2da99c1b394b1c415c461ae449dbc8d2145eb463a0c1e1d4fb01255cdc4841c41bc36fca68fdfd3d81018f182cc36fb0d6eeaf6536473d29064

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\sof.dat

MD5 16bb8369dc0845aea7b9bf0fc7727775
SHA1 c8de7af2d78f91ac9788dd8a0cf4c0d2486e40be
SHA256 054e468b231aacd9b0c94b7250fdcfe0dea3f0bae663c5f3278029e340d8dd02
SHA512 b9aec12f285d0d8ca3b8e791c1326d85921b3deb425979d2b927e32fbb706acf4e45128ad3e55a28e3a164ef74a33d7a8b62469920035062e8dcf761822143c2

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll

MD5 5965051255838a0e4aa0d0fe92c1c3bc
SHA1 05efb1eb3c05926dda3d9749a87c4d384a6e8b6d
SHA256 4e68ba5117ccd4523d92aa08563770e9bb81d46a4a8a69edfcd26138a61094c4
SHA512 d5c2c0ec2bb21d89c3612c318c760f2b29e24c9def602e0540f07d90df0d92363f58f63bfd2d868503460552c0729b1650deb3e9fa16a5f1910e64ac556b3eb2

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\scf.dat

MD5 58976b43ec26374c81b70376a048ba29
SHA1 185386e7de9a1a4be99a1009a9417fcca0f46790
SHA256 7fa51d420b5d6ff7ecdacfa36399ca16a9f393669a9e862f2126160bf6a75109
SHA512 84457123ed932ca13b648d53bd910fb4726f079908c07036591fac2a926e95d361d2b298af12cc7005f02a04fc2144a49b29303df4609cac8f028f72cd220fc4

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crt

MD5 75a97f3f179ccc3a1b8617b6938b38a2
SHA1 9f6c3e0a399e9ff5ad70a85ae6310a2a2367119e
SHA256 a034c29f8b46a303216f9e3a52aafbdedb864dede8cf632df05fd6d10e381fdb
SHA512 5488c0440716d37ea4dda10fad6ed4ce21d613c7aec9588741aa8740e2440e3f7ef1b6cd49de851b38153effe8943c8743aff8f57dcede25870528b7ab550250

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\ManifestCerts\rootca384.crl

MD5 ee71956f99740a9e15bbbd4e71b76f2f
SHA1 2f848ca3ad9d0345ca9c08748a8f4f457ace08ad
SHA256 865c9e89a44090820ac85ef791428b807e023ae7ccd23aeeff7e3e98fe552ea5
SHA512 5d0393fef86ba0188b63842c37dc71adbdf71b87dbb29d41dcc68648272bf51f1c2f4054106fb33b2033ac4c6859bb2d3372aa33e61cf1eb547961d9886ae9e8

C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe

MD5 71f33a40c8445c7da0ea83206eacc0d3
SHA1 90c404929865d187370e98c503dd13531ff81b44
SHA256 f8db4efd455ad9c589ee5ef73702ce9f1aedc16abf67defcfbcac5c59cb726b2
SHA512 7b88dd6787e1696634067ed289dd3856d92e3d38247bb7acfb76f7e2fa43d541bfaa27e15819432d622ead2fc1e4a1b1913bd78da518f1023583447e470ebbde

C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe

MD5 71f33a40c8445c7da0ea83206eacc0d3
SHA1 90c404929865d187370e98c503dd13531ff81b44
SHA256 f8db4efd455ad9c589ee5ef73702ce9f1aedc16abf67defcfbcac5c59cb726b2
SHA512 7b88dd6787e1696634067ed289dd3856d92e3d38247bb7acfb76f7e2fa43d541bfaa27e15819432d622ead2fc1e4a1b1913bd78da518f1023583447e470ebbde

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 6bbfd8e5321a9225eb5568290716aa24
SHA1 689e0e9fddfc0d2e6ab9d89bca1736d5aebdb9b7
SHA256 d432b7b629c257a3240986085246accd79c8624a6a1596338b99dd07dbb74cb5
SHA512 5b008decf5eb142df6160ff4a670dadf884c52d594ca273d8889857ce429572d57201b2364ae020d7c9683cbfae7cef4fb66e189eac5de16737b768e85acc979

C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe

MD5 71f33a40c8445c7da0ea83206eacc0d3
SHA1 90c404929865d187370e98c503dd13531ff81b44
SHA256 f8db4efd455ad9c589ee5ef73702ce9f1aedc16abf67defcfbcac5c59cb726b2
SHA512 7b88dd6787e1696634067ed289dd3856d92e3d38247bb7acfb76f7e2fa43d541bfaa27e15819432d622ead2fc1e4a1b1913bd78da518f1023583447e470ebbde

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca2.crt

MD5 450b9d35c9a0b33f80d9e8faa29a260a
SHA1 1f20ecb65ac24cb20512c9c4983dcd9bd0d05b6c
SHA256 92e6ccbe80f31db683e4c331b599efc91e593365af8895504a9360c087060d44
SHA512 4baa881f16f4acc75d71f79c36c503ab6e3008574e2dbd3714001cc217f72d0b430f651ac2b99cf5382b9d3f7eb625767a2820d62bcc3f00fff515425b6dfce0

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca4.crt

MD5 150c183892de69bdcbea89e8f59ac9da
SHA1 a368d1bdc8c44eee589320656200ef2bf597d69f
SHA256 4d44a6ba0ce8fc3771c6bc95d385aaa944aabdcd2d908d87ef5ca20418bf5d90
SHA512 dbba7932d861b5dad1e2ed53a643c5d35baaf1460a58a10486de92b5c7d722a570af5fce631c0f96bf4f6d7f4c4de4e2980b0f34b0948bea9c7f0a15198eeb26

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca3.crt

MD5 608b95a5138684796fe2b57ad00dac03
SHA1 0a2996f1d26f0e9e3a90c333dc7acc3830d3b365
SHA256 ab9dc99032c498691a788817d5af925ef0580f32904defe58b7a52d971d8bec4
SHA512 978c8743174ebe5de00eea6f8d0a9b45d8cc834c0dcd3050dd24d7386f81f8270c50094de5468d529765ab2ba6484378ec89f8b1b8a954845890168a9284c0c5

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca1.crt

MD5 9608edf834fe19c2bf34cc00f954eca5
SHA1 2277ed5594d385b4fdb3f532e3a48394c1c6f1a2
SHA256 653e1a599023b1eb88ab96137238d978529a070b828dd3309800bd131d8ffaf3
SHA512 a1cfefa8f12f54ab1d1b9e67e0893f2f4cc85bcfbcf9deac8f3eaef699bf336c11fead3ceb0e37453f3b5d7108134870c62494405349de4b0661725f5e0e8293

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca4.crl

MD5 4c6122725ca25070dc5352617795e105
SHA1 2a3aad2fc6e231e3109ed00467a77c2de570450d
SHA256 91a8b79af85e5a0d451e35ebb5214038777ad80421115e2d6b4f915fef1981a1
SHA512 75ec1d542e175e95b2d5a43aa0a855432e54993568bd6e95a1223deab3849cc102733628845ec02c68104d654e083ac59266da97f93ef321131be929fd3a7e34

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca3.crl

MD5 9dec7dba2a6449fa5457740fbef79d01
SHA1 a8e7da73b454e2cb3031d8b45df4748541f56cdd
SHA256 d1fd764f8a1bbf5fceba137f1b09eb6b76ec8f868c60b176db43ecc0d40d2797
SHA512 fa91a1e75ce9ad1860f787e54a20c719498706eeca11d9fb14d5095c6b88be64afe836a772ce6bfd739a5c1ea385c353fc99704d5c82cb51c1b90c5e857d0c27

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca2.crl

MD5 4512cddf97293ca04baff2337da700b6
SHA1 84d37d4cf345d38182ddf54c928b7d981c75faed
SHA256 de2c59c12a1774610b6c0952ade122028f892dc14bc6b568a44b2220897320d7
SHA512 eb90655188ed2cbd8bfad3cc901c6a0b51cab84ac82201d87a8611366d61d12d96fea3a5ac1e4ec9f048906bb72dc16f1ab19ee1eaafe962c547458f57157bf9

C:\Program Files (x86)\Sophos\CloudInstaller\Management Certs\sophosca1.crl

MD5 48ad0fbb2e473628ca6fbe5f40c1b335
SHA1 4faab71eaea67497af28a8c1fe59e783a431752f
SHA256 3484fe4376803d32c56ba6a850d330651be49e4b69e4de901b2100a80c25d9b9
SHA512 dca8268bb18f3219dbde371f59e6cbf5c622fedbc8ca450c433b03b2c1d87dd599da1c7bcd022ffbf6ac4d0d75b779603874ee1abd594a145214d05642f65f9d

C:\Program Files (x86)\Sophos\CloudInstaller\integrity.dat

MD5 a5c52e6516d01eba40f8d107b510f9a6
SHA1 6c99c4b2b8fd93e7fb62f9d1df167a25570ca78d
SHA256 affca98ebb36f3d35c69a5a34ca2c2c917db05e456698aa86feeff4251b0bc5d
SHA512 dd12505e530590f68f821dca1f0b87034877abc4bfd8454f6a0a85423c80831780e8c21776d0a3a8c4c5870ec1e77e1c8c6b98cb6f5201dd14bcaf515789bfe7

C:\Program Files (x86)\Sophos\CloudInstaller\SDDS3.dll

MD5 5965051255838a0e4aa0d0fe92c1c3bc
SHA1 05efb1eb3c05926dda3d9749a87c4d384a6e8b6d
SHA256 4e68ba5117ccd4523d92aa08563770e9bb81d46a4a8a69edfcd26138a61094c4
SHA512 d5c2c0ec2bb21d89c3612c318c760f2b29e24c9def602e0540f07d90df0d92363f58f63bfd2d868503460552c0729b1650deb3e9fa16a5f1910e64ac556b3eb2

C:\Program Files (x86)\Sophos\CloudInstaller\ManifestCerts\rootca384.crl

MD5 ee71956f99740a9e15bbbd4e71b76f2f
SHA1 2f848ca3ad9d0345ca9c08748a8f4f457ace08ad
SHA256 865c9e89a44090820ac85ef791428b807e023ae7ccd23aeeff7e3e98fe552ea5
SHA512 5d0393fef86ba0188b63842c37dc71adbdf71b87dbb29d41dcc68648272bf51f1c2f4054106fb33b2033ac4c6859bb2d3372aa33e61cf1eb547961d9886ae9e8

C:\Program Files (x86)\Sophos\CloudInstaller\ManifestCerts\rootca384.crt

MD5 75a97f3f179ccc3a1b8617b6938b38a2
SHA1 9f6c3e0a399e9ff5ad70a85ae6310a2a2367119e
SHA256 a034c29f8b46a303216f9e3a52aafbdedb864dede8cf632df05fd6d10e381fdb
SHA512 5488c0440716d37ea4dda10fad6ed4ce21d613c7aec9588741aa8740e2440e3f7ef1b6cd49de851b38153effe8943c8743aff8f57dcede25870528b7ab550250

C:\Program Files (x86)\Sophos\CloudInstaller\ManifestCerts\rootca.crl

MD5 58a298e534a6774cb506e42eea00bbad
SHA1 45369afdfe2508ecfab66d68662bcf8aaf88486b
SHA256 671f4aae65c8fdc2e3d7f49a431adb36e24bd3c5c16e3d188763fd3f2c38028f
SHA512 c94c29e9b4f35a9fb004029b7f3f478e214ca65106bf5337c3ea17f38ec856245d340c3a74160730b2903a97b8512266fe57a5fd18c671b93e57a6aab156d75e

C:\Program Files (x86)\Sophos\CloudInstaller\ManifestCerts\rootca.crt

MD5 9a151a43293fc19eedffd2a105962370
SHA1 42d3d2f8db2d57e5ae6d5618e01077135b955065
SHA256 311e7160a6812c6d4b552eb7cd282eb72a8f082bec8b51179794ab979173187c
SHA512 de3dd102e3c5ae35ea7e5784ec174548a5ffca7766c3d27c5bb548d5e8dce2decfe70837c0d26b5fd4475e88e0f0c008315075c3c39702cf64fac9f77053cf21

C:\Program Files (x86)\Sophos\CloudInstaller\SDDS3.dll

MD5 5965051255838a0e4aa0d0fe92c1c3bc
SHA1 05efb1eb3c05926dda3d9749a87c4d384a6e8b6d
SHA256 4e68ba5117ccd4523d92aa08563770e9bb81d46a4a8a69edfcd26138a61094c4
SHA512 d5c2c0ec2bb21d89c3612c318c760f2b29e24c9def602e0540f07d90df0d92363f58f63bfd2d868503460552c0729b1650deb3e9fa16a5f1910e64ac556b3eb2

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\DataSetA_2023.4.9.23.40.58.1.fb9baf667a.zip

MD5 b3e0adf49c69f09ee92dc69835381c40
SHA1 d88bf198bd4dd67a80f5af75e6718358e1c138c8
SHA256 436e3584e8173456ef3e78b5f7cdd4b86a484fc6666953fe2b7e7e8f5a3c6fd9
SHA512 cbe7a3be3513a6ebfe23253a978d4aab27d5bfb512b059e7590e8b4a98cfccf9205d7e2bfb227490d0161825d8105fb5cbb517597dd97c2e5908992d7008d82e

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\USERAPPFEED_2022.7.31.15.40.26.1.d97a686ef6.zip

MD5 f170212727e0eb94848deaeb899fa787
SHA1 3b96ec0aa59221f1d95521111b282b3bf15437ba
SHA256 ce077f510595dea6a6cdf25382bc1b52c5af33193d152ddaeac6809efde79f89
SHA512 5ff17e70a9d87664606cfef7c9e890742fcff17cc38a734dd5dbdbe270d895b054a22372f45930c1383b8190a0734e4a99ba0bbd7c50caa79caa48741b183cf8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\LocalRepData_2023.4.5.6.20.42.1.c43acbacfd.zip

MD5 82b027c92ff95720b0ded899a0044cdb
SHA1 992d8b6df5180b602b2b5d664b82ab3a24ee3826
SHA256 c630f4ceca839a7fdc0cac3aa1e9cd1036cd6a92d7223123fc4b1a3f72e84985
SHA512 1e6194d9b860b5500b9047cf64a619b9d65f698d4ba8729e6a6c1eefd04b1ae9dc6da1088087836900cd88370850118ae3b8f666afee5907f4c87253ad9bffa9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\behave_2023.4.5.11.25.47.1.0d8166a9d6.zip

MD5 1dca5a9e99e410dcaaa8268f58d43c48
SHA1 eae156b4617ad4645c3cb0f3073970c2a1f9d68c
SHA256 da3d0c1e87b2a5d7a1b8f3225fb131adb6fc5da2cbd597555394e280be475db5
SHA512 1cc6afdcbce14e434087c3f666543b537075c9ff6ea0ccf87d34c024778a755d489c18c4c24b1027609c098d7f61cd3f4fee986ffab0ee545ec63052554cbc23

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\TELEMSUP_2022.7.31.15.37.20.1.d495f3dbec.zip

MD5 ebd1003133eb6cca51ee4b6f5e52fe33
SHA1 d959fa8ab427d3fe86741ba2c1e2e33cfd9a2480
SHA256 930e517ab9e622eb3c875988e36ddbc2de3a01dff00c6b3a76a77095cea00dd1
SHA512 383ea420042a00ff1b3ee8dbc8d78dcf733664ff95baa4f3bc0dedf3c70d06e43a9f3de667db87e0fc53433da2544690fcaf0afe5685a457be6ab673f0d66075

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\REPAIRKIT_2023.3.3.11.15.52.2.1950369e03.zip

MD5 c1cea5f902d008b899cefef605bf2bd9
SHA1 ed557b75388068a8fce1dba505b02a62f1060b6e
SHA256 265ceb292453076c2d3978e17afcae2d46cf1e61d5f8cdfdfee3f09deaf21813
SHA512 1a9b235a2bda0fb5ee3a09eb8fc00da42600d46dadf138d833502648e3780efcb82ff9eab1b55b1c0eab85bf663b34a543b1e7afddd147e8ee440b4db78678cf

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\97B6A561-5F87-4A2E-A4FE-177F48D8899F_2022.12.14.15.10.49.1.bd81ab2117.zip

MD5 e7a5a7ee2af69e93e93616bc1535e45f
SHA1 463865caf9239df4495171fac7b0374b5fd74bf3
SHA256 33b3afb6c635847f71c03fc939f032c428f0fbe1ffbcf7aa74bf30608e3ca25d
SHA512 80abdb057f24ee96c8153abf70d5d6c4ec9ff1a21412fe75cb91f705990c432c5bde3e3b91f3031add096e77db16192445122f2f704017a79ca549d3afe99d87

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\ML_MODEL2_64_2023.3.15.21.8.30.4.d52fe2b52f.zip

MD5 0921b5616bfff13df239ca0afbf84985
SHA1 bdf73d29bbcec90a24591188958c79cf5ae9a8b5
SHA256 952b0cb976bb9257d66fc15681049b377d1ad20d7f2ca5836ea479f4b8bf85e7
SHA512 8d87a4a58addb4aec350ac3b99f86797d8d801eae42314793b2dfcb175aab469fac93652e48d9afed0114b834f4195808bb768ce78349eb42a4f375011e6d2b7

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\ML_MODEL2_64_2023.3.15.21.7.53.1.d52fe2b52f.zip

MD5 b6a2a7b7af82ac68a471e9f110663e83
SHA1 ff931491309241001d844d8a52ca8255d17e1044
SHA256 31522d5b4981ff8f61c5278096e25540d92cf3496179d52927d0632546dadefb
SHA512 82edcb948b11cc2f033d958f3c53cb0346635d04fb4544cfcbc40d0bfa1a74f3d8afe2e07db45096b5c31a827d760b332f0cf52277c5c89d045fb7025e2b224d

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\DOC_MODEL2_64_2022.12.8.17.15.45.1.80ed72d6f9.zip

MD5 7a6c1d6c47961d7f289c2a70967ff773
SHA1 4fa76ff3a191bfb6e010801fca06adaadce5ff86
SHA256 35449f59ce447eae889c49366b6cf162f7eb02132d34075414d3beb1b44d8b94
SHA512 1b6f426f6fafd82c96e8d22edc9950f58d52a8fa6d49dcb195ee45fc4aa105c2d06c9a557f6ea078d50e473bef29fefa6a6d9d5fe96ad194e2b1963200b162c3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\D3147E4B-BECB-4CE5-A2B4-DD098CD8AEFE_2022.7.31.15.32.49.1.d9144bb61f.zip

MD5 5f32ace505f71c7f1d3513d1da5e8b30
SHA1 3f6d4fb20600830ef171e0fd81277e6088d7ed85
SHA256 587c87685433077e8e42b91f598f6787a9e3ace732c7327e3ed8808ae9f54f48
SHA512 4a5ad41552bde8fc6bd91fb39c9c358154c5409c6b57e08f18aeaa9f9933b6202fc13fdba0709091e3650271326ad71ea46a90fa27f99bc857f718e1532d72a6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\EPIPS_data_2023.4.4.10.25.43.1.554d8bff6b.zip

MD5 df74e3b500f9d70ee7c4dd7a4eb4d2d0
SHA1 5226d2c7ea4756d2068f8f19bc044e5a2716ea26
SHA256 4c21f5f405c9ea7371d4e5ab1a22bc51ee5ebd5591e022c6fa12b296eb98b6e2
SHA512 d4e6e88d5fd1a8b2a87fdf4325b28dcf664186e7689924ab887395dfc05b5b52cff90d8ed59af2300594f5885d8d1d5b3cf4ca7b7d6ea70c4929d73c0ed22068

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\NTP_OVERRIDES_2022.9.22.9.50.46.1.484c9175f6.zip

MD5 f04498c62282ed23a6107f758bb171f6
SHA1 593fd019464dada0455eca0eec5ea1d175a31db7
SHA256 3e32416e3752d0aaf6f6fcf4ea2c172c00881b11b063a11f0ec038f50b31a67e
SHA512 098a66401ff6a2f9ed8e0c9ce269cd6db809b2a1bd86fc862d8e1d9ebae4385bd96f5fdc3fbe7ded2a7b4a7d8662546ac754fd931b3e1fae6677528352823db9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\~CEPNGFLAGS_2023.3.24.10.20.47.20.538428b500.zip~1424~65.tmp

MD5 835135aaacdb753075f1fd1e3b4ebac6
SHA1 08ad9b431c14b720483c220a3596ad517ae33bdd
SHA256 e39f5364446734b1274c98a56a93493749522ecbb29ee583994a5c58a448177f
SHA512 2a11a9d86d818c1bdd40a1f588761b04de4b908515ef3a9efd3d8796e426ab4d41c8f9580b903baddf6149a9000e97f4794387d7fa7d47fcb3dba17d4fbe4abc

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\hmpa_data_2023.4.4.8.55.41.1.3a64fd2109.zip

MD5 6b80ae7f541ed3f64d2a72683cc70b00
SHA1 b79aa6a3fce35eab837c49bd124d383255b12b1d
SHA256 8570df055bbf99a52832d3ce8af3c9b25b55c3b080f6547f1f79ae5fbce21c0c
SHA512 005b4cd6b107e2d606f853f19f5cd0bf3f27db996c9b0d86dd11f76ad04d9c4e0ef23b9e9fdbd0b87896aef231dc17e3411c58328c4ede061fc3cafca7a21882

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\CIXFLAGS_2023.3.23.16.15.42.10.f5845b49c5.zip

MD5 fe662df32fdb93a4c2468928700f8907
SHA1 089a72e71fc3d2487c06610b7b918c49b3b15879
SHA256 5b90d4c4d40a000540c89ab2e30970cb3bcee6ed16920307cf628a8dc539a1a9
SHA512 90e32c9e489c279c30c1e108f4bd17f0619c9b7d37b7d80e0e4dfbe94652610181ae588c6d77bba62c1fcf7d13dd6c3a1c4e32cd2c1751f3565f29e92cfaa358

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\WindowsCloudAV_11.6.562.af7ca712f5.zip

MD5 b0c41ce0fc044bc45a2e639cb1684b9e
SHA1 161bb9670d3f6f5da96a64bea90fd12ef638853e
SHA256 abe9e66c64c3289553071c870c8e22c4f3ead09597c863449e68203cf9eb030a
SHA512 5dd610a09309c6ee966116764a89b142788b899b6f2d44fbe93a334811c995dbb60e420809a9afe7a25cbb47c3cc1cdd045f174b00a20e0cf9043a0dead7631d

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\WindowsCloudHitmanProAlert_2022.1.3.3.ec431a0bab.zip

MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\HMPA64_3.9.0.1391.c4662c5993.zip

MD5 50fc9a56e75c947de0f75211c8c2a164
SHA1 695e9352de0fa00165e2922413de8331b40570a1
SHA256 25088dababc1a8a98ff7b5625e195d34ba03801b78ff80e3ab6a3ad499cb968e
SHA512 105bbeb596de5ed04b7fe82f8402e67f9f8fe39ce753b7590a306211692915c94fb5ffeb70d8e9ac26663e4982e61a9a17421107ba429aa73154672e8a1ef7ea

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\WindowsCloudNextGen_2022.4.2.1.0.a0256573a3.zip

MD5 10d313fe562202636647142c6b769e65
SHA1 67d0cfbee10289b17cc1e3877ec1ec48b17fbea1
SHA256 54a8a94f28048a077fdd0eb382182c964e5f3bd1a17c9284652e016b899762f5
SHA512 76b96738951ad75ed0e4e37e11defbb92d2319326c41580280a600feeec612f25471fab1d24b9cbdfd90b8ba8a8fcceb898c83ce212be57abb3c714cfb9bad19

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SDU64_6.14.842.c4bc10f914.zip

MD5 6779fcb6ef160bcbb625cc8dfe6aa48c
SHA1 9859566ce17ad3a2bd2ab8089e7838f8725d9c86
SHA256 cd9ae46257b6a541a975cf91aa8d32848dff22e2e8e093d3e472271c52e591bf
SHA512 b1a1b5d191d593d0521fbf242febac7481d8b5d0266fd7e96bf1ec997c206961512e07bbcb0162e68ed350b83237d05fc825719d5567e054788d0df57b1bdad1

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\NTP64_1.17.1467.2467356c1d.zip

MD5 222103b13c82e88e2dc08d5c79436617
SHA1 b76dccb17296ccbce891d9e24f48b26e53f22eb5
SHA256 ca2d4b2167573329d1e57bcbb91dc2d55f432bd6b14460fddb3686d4f402559a
SHA512 fb2fe0fdd197e024205dcae89adf24cca0cf9b5838c3cf3ebb54ed3b2a48794b18ccc40ca1ecafb7ddb2aaf3b57785e8fce5d03ba15e7d01b4709936339e8fa7

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\EFW64_2.2.362.8106c6770d.zip

MD5 93230446a2d2467775c63acee7926756
SHA1 dabd0b5c0f023022a577ae2dbb8f4184a0177875
SHA256 09b51d6dacb955e9d507e1340cde95eb7c2928af9b1a20c7f1dcf721f8cb88d8
SHA512 86bd4124ab88c6866fd866867892745a47c5a995201688e8664853f46cbd2f4af12e77a7eee55166c2bafa95bd8016e58db0f818f3d483852db78dab878f2ebd

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\ESH64_3.3.179.0.5d6a507556.zip

MD5 d5d4fe2db45b7b5b8ff3d27a17cd0855
SHA1 4b0ddec868731a876ac8794f956e2177e24c3ce8
SHA256 6415aa473e96238e3e47660dfe3a4564659fc52ed95ead14f4298d0b25cee9e8
SHA512 ab8771373362a22afa2deacbfdbff6068a4b9cc8fe8ce29ed522deb770034e9862a1670bf0f0fb7705fb17eeb52098b1211248ab6365fe9bdcb9a85cee28a416

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SME64_1.8.17.9.46c677f356.zip

MD5 b81358d9cd36c2739f72daf0c01b7e9d
SHA1 b8d7dd8c980ea0a3a6d112bb971faface4d3d362
SHA256 9c4de434d2be22d1629e214aa311b4be2f66c0ab664d44de3d3265b5300532df
SHA512 47d5124f5713d9b08e1fe43308dca9fa0883836ad75430f3b1d0c99fd638eac3490a929138a19b35e81a56822df1a26f1457df8922d9b8312637f04171f2c86b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\AMSI64_1.9.874.91aaa0dbee.zip

MD5 54b3faade05865b65ef6f41687b3074f
SHA1 05677637213ead1da39a790453aa88baee016fd3
SHA256 e2c1c6b07ea4d9ab88c261e8a0d7416276d3db8bcd8fe341d5eab54d81f42f6b
SHA512 fdc2efed60b260496b1d7ccecfdd8a56f5386cbd7da36d503d721a42f1f90bba63866e38720c7d47db3b5cb7b868029a6ac23d1c4dc6ada0d152286e179608f9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\UI64_2.7.258.0.5fc3ddc8fc.zip

MD5 f9bef3cea346b762ce1fe8f742a36a1c
SHA1 b44d50675805338bb260c90bfa8f35529078232c
SHA256 983b33513c4cb802bf38dc0114481c66e7bcbefcfa446427f573174a4fccb7be
SHA512 e0236f0da5fca9590aa24f1ee5589a4f584b385bb31ec3955a873de9cf785693ca76c10fb28f1eeaf7e6ff196921db0fff0221dcc0bc84f204b97e8f0f299c81

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SFS64_1.10.7.73.2d9d26514c.zip

MD5 4c735128d039694cb542e5d6f2eba9d0
SHA1 2cfb187b82920171d6eea8805948035a7dba2f14
SHA256 5cf531c94def99224c12c68131170fefe05d4460076a4816ce796e561a52ec5a
SHA512 c1c558e53100bc710e5e05459c81fd77360bfc1e90f9224601ef0a33d07f0b74f45a2a02d608023d84562c622c33d3d01379942da1f774e46fc180bdddbb23f6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SHS_2.10.183.0ab44ba398.zip

MD5 c04dfe4d427d22020a6197c823716e49
SHA1 f75312a339eeed366523ebf77b0e9cef13e765dd
SHA256 ceb4924d29fb1efd03604f778cc27fc1a6ae3b1555352914055320188164187e
SHA512 50781071c89fa5c96f56918ab5006df752dc94499c5399d7279470be6ca62fb106b7c33978627aa883cb14d48325e28e2be857667bbc9bf1c2bc0437ebe368b6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\MCS_4.18.215.7597bd5c53.zip

MD5 809a1d07b2b8d0e60f4159724157b219
SHA1 4642cb2d4c8f3382f167138be247fed4f4ed2cc7
SHA256 78869962cb4e766a47a871be7ec7b6111e5ad347615db1a1869d3030e2f5f798
SHA512 a3715f232437292d83fe1d85f2d63e239a6911479b25d82b033056aa721cdbb20b516937d0fdfa07213cd7af47b612adbbcce9f62f194675f5d8025ad8e77dbb

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\CRTSETUP_0.1.25.d8119030fa.zip

MD5 ab295b37e0edb637e2a4f7ba5c1eeaa2
SHA1 d5c48e99f22f977cd96484bcfa68e6e55bd92986
SHA256 8fe80d98f1db07b427cb937c8e89122f454149404b5c85f21225640fbbbade83
SHA512 d215c7b186c4da89a37e9f55b431f73ed25a4d327918fbc1179147fd3d5925ad8c363c813d9b10c86867024a132ce6afa49d1d793bdd589a1f7ff8925b2e6592

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\UNINSTALLER64_1.15.221.221.f7120e13f4.zip

MD5 bebbe86afdbc38f96b2932b23613fdf2
SHA1 b75eaaac0b1d19809566146dc1d59c98c2d28b0e
SHA256 1d3fbfe3bb80c84fc6b276b48cca27d4e20c46c5f6814b7d5fc79d250de29c57
SHA512 18cb834aa7ad0eca6f34236b2a32f93c73247f7363d6601c8c64beec2e27d0d49e67363c44ca4ce8ea35e9928da3c549a7df7a3b7642c063fdca9d1d5c2984ae

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SAUXG_6.14.839.7cb815d4e3.zip

MD5 351b3bdd725619efeecf645cff31b768
SHA1 cf0148f1817912912748cb4b46b5e4262b26502d
SHA256 a0d88d5b8cf0fd8ca00cb0748885d27e7f0e20a1219b5b2c72694ccf28c9f4eb
SHA512 d9699583816d809cf6cd640ae3a2d6366914e5c3ad6e41c6829b604b37bb0d8d0b9ef0cdf86aedd112538174efedab2921e768888c06794b35fa0bf77e6c95a0

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SED64_3.1.2.905.f138576f27.zip

MD5 3fa6b5a73414add07b8ac2946ff2135b
SHA1 b600ba033c5907d88ce2c13b279a7ee919f12fc6
SHA256 2df76708ad54990c0db73022dea5d1290056dc4df2d9e563d0d14ac897daf537
SHA512 0757d3091e3b95a5d0eb53c62f5e199cc8aaa4a65e0b0f324016455391057afc28974775d1af15cc0b5e86ee268ea01e181f1c2ae2951871a3b2ffec977c6607

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\package\SSE64_3.86.1.4.372cc0128d.zip

MD5 71f9d82e61a6676d29a552dad887f67f
SHA1 5503be33d6564b242b2fcd269a4f81b5d8ee0c76
SHA256 bd8666ca1bf1cf02094285a11ab47ab3a778b5bdc0e64d54c0b795695ff13623
SHA512 5954ee1cc60754f1fb306aa69c42d9191df036e46e1219577efc80c94be34c35a9cbc57f6d740cf943bc22fa0bf030a246c995302e33b0e1997ad8d27b5780db

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\hmpa64\ssr.exe

MD5 f7539459f263f29e883e37dd60c08673
SHA1 dd1c6f537931330d95f30be64ccbddd009fbc3f7
SHA256 439ac8b4cb367e16c235bbe38511fa4d258a994666b2a6467210f4060361cecd
SHA512 4e472fce72a5a2c9d5f1097972f228f6ec43c9b78cee96def2b5d5e040d6d3f456bea8972267c48c1fccdcd894e38be25985e2475fa997e767ae62d9155bf805

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sau\license_agreements.txt

MD5 842cdc4266c2e0dc7d3fed57ada5364d
SHA1 c90ef9db82cda0101d15fd0fe832a662f0302c72
SHA256 2348731bd932a2af9bd24a647c0bffe4f999c26929e5bad5f19b521ba535e661
SHA512 99c9cd3d07a3985c918b26e1678db28cb0af2d3085f8f06aeb08ab3afa4512d122948e8e6113de515c826f8d26299d9851d74c60edfaa9e365aaa70e80f7ed72

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sme64\scan\model.dll

MD5 9c8d4796db0d6f53e937e0038242faeb
SHA1 82d4fb359d93eebe4d3f8cd7e3ca0d4f5595960e
SHA256 817047b9490a9af69709afd78f3ead0dc930ee35b90ec6e88edefa85e32145f1
SHA512 ba60afb2a7f006ab3cc9e6d2adbc479883d2176647a59a88bc3b03e81e57f5947cf8b3f070f3611d0d87e71cc3d0e98557a2cf4ec4dc92c4f65f7e185da34d5f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sed64\sophtlib.dll

MD5 51ee2a9852016a5de28d0b752a465c5e
SHA1 1c1ad7d9c2ed11213e0f49de34ded04979aa3bf3
SHA256 c0731b8a737b983e5e63b4397c47bf28bfb66efa8c8ead47157ebfec9266271e
SHA512 e0d186715774088b4f883b64cacf69e66b408a8afd34a4dee2149a762729ffcd1f90dcb5ab1c6340fc59c0ae419626811a5fd21539e0855dc9d60e4e5ca926f3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sed64\Config\LocalReputationData\signerrep.dat

MD5 700d7793e6a58ce0bb4bb1d089c5aee3
SHA1 8007a0cc47fcf97ff732aa2ae613706a2258e4a3
SHA256 ec20b33679fe6818d35579c659db6c24396ff21abf99bf5cb839941a22c2f5d4
SHA512 b1dc4edbf0ad5b2ae4dbd9fd2dbe53e313c49edc3b4f0e5d7154819c52c790d2279c830ca8f78e67a41d48d8558a4c694b601b637e16a832ad2ce06d675552cc

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\sed64\Config\LocalReputationData\filerep.dat

MD5 692da88c48ad8b58bac67b784c5ac362
SHA1 fc5bf629a04a231e0a5bb2cb2878658331acd8be
SHA256 daf219ddf8e0428fc0306a97563afab0a28e108d4b54feb8994d89f891c9f330
SHA512 57b193c4a7247a9f37e3e13ec9ec1e1c177cb303c761cf150fc01ef4ad506cf2557882f65804742c24f4148b9576194d0c316f6a8e63fb6d0edefd45e7b6f6a0

C:\ProgramData\Sophos\CloudInstaller\state.xml

MD5 40f981016fafd5a06d8c6b88fb5145ca
SHA1 1cf6102ade48565dffad64b3e00b06d8ed3c2592
SHA256 89a0d5dfdeaea442f498c16a2bb5a33c2b4b7402705cba01ff3e8902bc4baec2
SHA512 971aea622a31091fbd199ef74a18d8f8316b685eed2b4518aeb85670b359e8543342ffe9364563a2ff9ee02b8f7fdf3872727d6fff6ef7f8679153df294bc0ce

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.USERAPPFEED.dat

MD5 76b86ff9033da25bd300a211ccc66e65
SHA1 570a7f6f8e7fadca6f3a91947b51117c422ebb5e
SHA256 96e47662905e822c1570d50178a9b292cf772d27deaa07b91f4f8d1bdf88b074
SHA512 92add1cd367f1bbb519fc9ffaab5f988ea8e4f07929ea67467a1d479fb7594adfb21688ba8716dc8348043fda71f395344cf288fc24f034a5a39cb633c8fb119

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.TELEMSUP.dat

MD5 cc0dc0e68a0c2d15939726f606e2111c
SHA1 e05f7186ccdcfa223f387a4965230349e8049ff1
SHA256 a8d33a979b8496b7c7bbaab66f6e06e45396b436d13641178d5f2fc0eaeab218
SHA512 58c26d5e5b6377eb00164a2ce175836c06da792638c6b1ef1a323903ebe9ac65cde6a2e143162735aef47e1c44fe6d77c098c58ebfdd01e8efec5ac6a0774214

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.REPAIRKIT.dat

MD5 99f2ae2753cbfafe8dacaeeba6a82614
SHA1 d119af9a14ea5f1c1e09d2575059c085e0e492dd
SHA256 e161d0400f4f7bf9968900f2ae969e61c6d933a80c9947513b1ca46eb8b5349d
SHA512 2359658617b53852ed76084043d791594bd1f86d16284cc50617d0732e92ab5816e3695666db11e83de984667a1a823987ede23c7b87587cc0c7baeed8098c1b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.NTP_OVERRIDES.dat

MD5 6b5c21206db16c0b09f27d1af427602b
SHA1 30123045484eb5b87af20473099968d19b6d4b18
SHA256 03642137bd58342f6d2edf9f83b3d3dffe74182fb2cde63aeee2de6e51cb7249
SHA512 35d1ae1092a98264bb4b2e0051255547e3f208aaab0013835228aa5888af7faa9e455d20b55924373c7a572660cb88aad42a61ebbb07f4365c51b671300a1233

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.ML_MODEL2_64.dat

MD5 f53faf21f589be3c9b2eb8703ee5b170
SHA1 5df26a58f9d6f6d2f3041234f6c987960e8c14b5
SHA256 5d67a64ce1c26e3f2d2912734d757c19335b7db094bd30b56c3b4dd3e4b2f985
SHA512 4b64440fbe40b3f18ff36eb8f9aa126ec4064c504a31679857738051e2be8e99a0ca70ee1470b835c042d054efd3fac5995d8a579ec1bbbc8c7f38d9de4a6b17

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.LocalRepData.dat

MD5 e9eeca79e4221e4a3233a82479fd9390
SHA1 72945c7d1481629ea45079a06faf98f497e7334f
SHA256 2b3978a8dfd0d294f9d5c2d7a8cdf4faf453f04a25b49d377ad97132f2306a14
SHA512 9a2f4e476deed485837b72a8eb6ee90b0132af521d2e5adf20156003ab6029b07e57363e00d84dbcbbac8c0559d8fb4b8682005cf958373e3dacab0c0814eab1

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.hmpa_data.dat

MD5 189a858595b318eebd9293ca3d5439ab
SHA1 c29dfa28053e03c6efc6e92ebf554880c67da9a6
SHA256 7055ad501a302d69f8341af80d59bf50c113e2a19e6c51d9b0fba26202cd7069
SHA512 0598e4d2a3a626657a3995cfc8480062185d1a023f52a5e13dacee80e2ad9d4bf047fba83fa649df0edc8d703611c9cce8a937840105588a5742bb9915718ca6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.EPIPS_data.dat

MD5 ae28a100617b07c35ae88456e6601b9d
SHA1 2367fb02f6a82121e846486a3064f5c3698a7a8c
SHA256 0b2aac46d361d123e755af8262a2c2c455f7192128dfe20973eed16efb9577ee
SHA512 b06aa7b1dcbc866b0f966037633fdbc56106da761715b7e137bd6993c2cfc3528a8144d2a77f5d13cd8e4df47392e843d08b342effa636b6663763c3c5a479d1

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.DOC_MODEL2_64.dat

MD5 1539731a1feda212edce8a01e0d3a144
SHA1 a2a8a5e6065a47b794dcbe69b8b23d17f2d320d5
SHA256 bacdb71496021536a8832e5e9c05654c71cfab4b537a7540c2c8f2fa2151eae7
SHA512 ee499c3faceb4ceb3b69c5fa9ebc9cb1c30de81cfc23faca379b0477f62e7645a1f60f91f788c8951dc0da5df4232141fbb4a86bb275998c6235352f11e10344

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.DataSetA.dat

MD5 5d0661343472cef6b0f067ad5b4b618f
SHA1 b6bdd638a67a256b43a149d29be3ba64dab6a7cb
SHA256 e5c73270828f9af46180f9058f94890de1a43ca8bf2adf7cef561556274746e4
SHA512 23b870ddd536c6cce3a6789c36ee0623841b46a5a658878c3b8d307447fad1875bfa0bc5ccb0bf59504f95dfdad7fc10efcd517ab858a8719ab9db9500da1a1e

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.D3147E4B-BECB-4CE5-A2B4-DD098CD8AEFE.dat

MD5 eb8fcb65b742bfde0f631e872ebd066a
SHA1 c52eb64485158dd6d95d67a4b9c7de6c436c5c83
SHA256 59ce5ffb7b8fd469432c57dda680cb7121363c9f603e6aadb0a27050bb821a6d
SHA512 3edd9ad84e9abb88550ec24e84d3c4dae5fdf5f211dfb1b6657037ab5c89a8d8abd42c8168b1af7e733ed9f853f4c7570e92662af3b0bd3ed23cc6d0471b32ff

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.CIXFLAGS.dat

MD5 1adaa80614419048e216165574b61359
SHA1 edd21bed6f9e96609a5e4d0e6a286ac9b2cb5dd2
SHA256 dd0fc26c6b21b4fe09c840a7ec330ae7c9cf98eeae2546d5af926ae95ce15503
SHA512 57799a360bdf0397b8382c84b257760799978c3910701f26cba4db0d110bae76bf174f9294c03c60963c1f32ee116fe9bec3637f5ad7cefe2f45549147e97348

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.CEPNGFLAGS.dat

MD5 51093597607a7e6922a44cdae6a36de7
SHA1 f1fb6d24f9434f26e1d30629ff2f0126fd8a0ad5
SHA256 4384e645b5015e5d00e55bb904944f90eb01acae6ea106f0670cea14106ff3ce
SHA512 2f66addd4b91dfae31a592fbb9d329a7dae5ce0c653067f1652bee81467acfee4ebef26135b565e7cf8ca3122d2088c658885c7e408429a1c5e5b79e8ed178a9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.behave.dat

MD5 2a4a468ea93ea298cdc6dfda5c06e6f5
SHA1 0750f1220b1b4956f979c46a0e1b92a1108bdab9
SHA256 917485ed9cb57fc7ae43fcba40a29e7c0e2ae550b5ecb4f9e0e7db4c3edc1d20
SHA512 174b77c80b2ed8cf6e47d624e15393d27173fdd6a41e08580f60532057732b0152245d0e1b41f90b5ff52b764461ca437ef0d13e2e154b6317a869e68f4d98ab

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\supplement\sdds3.97B6A561-5F87-4A2E-A4FE-177F48D8899F.dat

MD5 da22196d5911cb3746b15aac0735f8b5
SHA1 a5103e4fc195aa1cc71e83f6d548b32baa5e9f75
SHA256 0801a97cb1fd5bcbdeccadc8d148dc991f733b60669bd4c6e3a4536f215445ed
SHA512 3d10d7b251a3cfa5da742fbc64730c812f46f311e98c5c61084e77ca6247f6e9e6b9d624d282af79555d93c1d7b63ef223cdb5a6b45a8567f1fc33cef3dded3f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\suite\sdds3.WindowsCloudNextGen_2022.4.2.1.0.1a02804404.dat

MD5 7d4fb6c17d8ea876566cfb421cd03226
SHA1 464395854aea20e39fd8c53df2ef1202c111c8f6
SHA256 b2b860a90d50441dcc151dc3c519d47ac58739c41eee15d8f65868dbd06071e3
SHA512 8f79f239c6fd6bc4693276ef8736269f3bafe785ca88126f8c25d7ed521285a47cd253e7a192b5a8e2564dadd1998bdcaefa85742a0a0ac4e0e5d138bd865838

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\suite\sdds3.WindowsCloudHitmanProAlert_2022.1.3.3.0.cde6db1a43.dat

MD5 440bb3487ab5d1e8bd83fd2376ed1a9e
SHA1 b2475a6558c4fc1f9c1729f7966acdcff08bf97c
SHA256 2af3cd9d92cae95ff0f33bbb28ebbb60eefac822b1ef031b851890a9065c3243
SHA512 dbf6e3369d3460a1d1072f7608ed1a548204634f7808b74523aecfb55cf51ffa363df662763381fa5733f7eae456c88de14d603347093688c2ccc2dffb4db2cd

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\suite\sdds3.WindowsCloudClean_1.0.42.55133bcba5.dat

MD5 baada013c100487ea2e53ab4a711b091
SHA1 320e03b6ff0492ef774a7336d1664ab6daaeb9a7
SHA256 f521ad32db48b79d26aca61cffe86eea0ac7fea3974a73b424aee18c0383c614
SHA512 1276b454328f1dd2b9ce3889927e933afdaafe8dbe6b7a660b291ca1c61d4c430479ef4920d78ecaa8069a24789153be98bf1947cb77d8d7c16caa46774ba2db

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\data\repo\suite\sdds3.WindowsCloudAV_11.6.562.93124a541a.dat

MD5 5c679397b1265def21922c365110e0f8
SHA1 07a4428c4aad323d5e98993f3fe301bb6ed4de4b
SHA256 f719fd3056985800a8dbe495255f9918464b8c973f2f689193cfa4ba0c8cbf7e
SHA512 ccf0d94bb52e11e6d52b2c578a6365102859ec89cfd6b4667c2dc54e703cbab0645fecf0b9ac08e91788fae1880ec8e7a0e57bf46b94ef9c7ff22ea71042a854

C:\Program Files (x86)\Sophos\CloudInstaller\su-setup32.exe

MD5 bb9ab5d510e4905307cc7e39c07210fd
SHA1 cc9299ec2e106d0b9becacbe4db6df86a1b4d795
SHA256 55fe9913d6187ca9d6734c5e41dbed6ad3d3631b878875f8b5905ad2107829d0
SHA512 c3cfb1c1147ce2da99c1b394b1c415c461ae449dbc8d2145eb463a0c1e1d4fb01255cdc4841c41bc36fca68fdfd3d81018f182cc36fb0d6eeaf6536473d29064

C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20230410_132829.log

MD5 0b218ef66e5010de460c0d5cff79bac7
SHA1 caf0e3126e0a3ec40b839bbf080dd661bb81a067
SHA256 437c3d80d6cde0af510004f3a66a6c4d5ec561f366005801499164f271fc97ce
SHA512 a99a1df9f5ea2f1fdee399f700e77c3fd327e44ff139e822a1a447007202fcd7e7aff38dc891821294b8ee60070b5607a2b4cbe3eccc09408e65e20aea8e10be

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\setup.dll

MD5 464f11783a893cd24d4a2ec981a85c8b
SHA1 bc9259b151d21e539f049a9a0891cc0af456f5cf
SHA256 6f4b3e3ed7bcc63d6b9e7eab8c6dcb7b93f13465ed84ead8b20aeef5cb41b755
SHA512 d6dd0ee5e634970b3fc1b11ba3630f7b67721769a4576223c14a6d141b027d01f68b99df13e7dadd7317d5a8a8013348da7ddd6dc021e38e27658dbffd2d2946

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\setup.dll

MD5 464f11783a893cd24d4a2ec981a85c8b
SHA1 bc9259b151d21e539f049a9a0891cc0af456f5cf
SHA256 6f4b3e3ed7bcc63d6b9e7eab8c6dcb7b93f13465ed84ead8b20aeef5cb41b755
SHA512 d6dd0ee5e634970b3fc1b11ba3630f7b67721769a4576223c14a6d141b027d01f68b99df13e7dadd7317d5a8a8013348da7ddd6dc021e38e27658dbffd2d2946

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\AVRemoveW.exe

MD5 ca67bf6e0625bece205400713b165ef9
SHA1 3d5357e5f8b8c57420a259399ff4185ba37332de
SHA256 f05f86b95aefced4349651ef95d5c00d2eb8aa52215585b456aabdb9dd19d342
SHA512 24eb9cb2d7cc076b1433c516662e0d7c0e2be03ea1e44896b8c3f7db3fafc16ab2a8b0555c561167f7185d4ee655da5fbf4af85d5bff64786d8668cf3a8ec885

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\AVRemoveW.exe

MD5 ca67bf6e0625bece205400713b165ef9
SHA1 3d5357e5f8b8c57420a259399ff4185ba37332de
SHA256 f05f86b95aefced4349651ef95d5c00d2eb8aa52215585b456aabdb9dd19d342
SHA512 24eb9cb2d7cc076b1433c516662e0d7c0e2be03ea1e44896b8c3f7db3fafc16ab2a8b0555c561167f7185d4ee655da5fbf4af85d5bff64786d8668cf3a8ec885

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\avremovew.exe

MD5 ca67bf6e0625bece205400713b165ef9
SHA1 3d5357e5f8b8c57420a259399ff4185ba37332de
SHA256 f05f86b95aefced4349651ef95d5c00d2eb8aa52215585b456aabdb9dd19d342
SHA512 24eb9cb2d7cc076b1433c516662e0d7c0e2be03ea1e44896b8c3f7db3fafc16ab2a8b0555c561167f7185d4ee655da5fbf4af85d5bff64786d8668cf3a8ec885

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\base_library.zip

MD5 25fabd6828c253e8f1020412d570f1c6
SHA1 88302babe62e317bddeb8e9182762439859cb65e
SHA256 30ce57a74311df2a3b294923c15b33431d8cc230adabe82bf87cb3a8ae97001f
SHA512 bf2fa1efb4715cf82aed3f739b9011de6645d2896b571f1ed585dbb863f236a480431a4775af459c360eb0ae72354396ef9df4b0661cfed5db329d5ed3b79ffd

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_bz2.pyd

MD5 1c52ba084a3723940c0778ab5186893a
SHA1 5150a800f217562490e25dd74d9eead992e10b2d
SHA256 cb008e0a6c65ddb5f20ab96e65285dee874468df203faeafca5e9b4a9f2918dc
SHA512 b397508607a1c7ccef88c6a941398f78ba4f97cf8a32f40764673db34c20eea61364148260d87014348613eb07e959a043b505702437e33927249899bf4522b3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_lzma.pyd

MD5 f91a9f1f2efee2f5dbae42ea5d5d7153
SHA1 2575cc77b51cb080fceed9810a9f4b2903ae1384
SHA256 1f82bb06c79b6b392c92cad87ffa736377fa25cd6d10da8d61441d42c0d0101e
SHA512 df1dfb8c8cee3496a60eeeb6f0d3fe48e1de8af5d04667f9a3124b769e8edd886cc46e6e4d4b277ee5d30f9f70f6f8c755097ddd996573a6817a5bb335de919f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_hashlib.pyd

MD5 4f51ed287bbae386090a9bcc3531b2b8
SHA1 26bd991ae8c86b6535bb618c2d20069f6d98e446
SHA256 5b6da4b43c258b459159c4fbc7ad3521b387c377c058fe77ad74ba000606d72e
SHA512 2eb2ccd8e9c333b5179cf8f9fd8520cb3d025e23a10dca3922e28521cfb9a38f9dd95f5d4f2784643eed08925d9008e5238ff9f93bdd39ee55414131186edff8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\libcrypto-1_1.dll

MD5 aad424a6a0ae6d6e7d4c50a1d96a17fc
SHA1 4336017ae32a48315afe1b10ff14d6159c7923bc
SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
SHA512 aa4b74b7971cb774e4ae847a226cae9d125fadc7cde4f997b7564dff4d71b590dcbc06a7103451b72b2afe3517ab46d3be099c3620c3d591ccbd1839f0e8f94a

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\libcrypto-1_1.dll

MD5 aad424a6a0ae6d6e7d4c50a1d96a17fc
SHA1 4336017ae32a48315afe1b10ff14d6159c7923bc
SHA256 3a2dba6098e77e36a9d20c647349a478cb0149020f909665d209f548dfa71377
SHA512 aa4b74b7971cb774e4ae847a226cae9d125fadc7cde4f997b7564dff4d71b590dcbc06a7103451b72b2afe3517ab46d3be099c3620c3d591ccbd1839f0e8f94a

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_hashlib.pyd

MD5 4f51ed287bbae386090a9bcc3531b2b8
SHA1 26bd991ae8c86b6535bb618c2d20069f6d98e446
SHA256 5b6da4b43c258b459159c4fbc7ad3521b387c377c058fe77ad74ba000606d72e
SHA512 2eb2ccd8e9c333b5179cf8f9fd8520cb3d025e23a10dca3922e28521cfb9a38f9dd95f5d4f2784643eed08925d9008e5238ff9f93bdd39ee55414131186edff8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_lzma.pyd

MD5 f91a9f1f2efee2f5dbae42ea5d5d7153
SHA1 2575cc77b51cb080fceed9810a9f4b2903ae1384
SHA256 1f82bb06c79b6b392c92cad87ffa736377fa25cd6d10da8d61441d42c0d0101e
SHA512 df1dfb8c8cee3496a60eeeb6f0d3fe48e1de8af5d04667f9a3124b769e8edd886cc46e6e4d4b277ee5d30f9f70f6f8c755097ddd996573a6817a5bb335de919f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_bz2.pyd

MD5 1c52ba084a3723940c0778ab5186893a
SHA1 5150a800f217562490e25dd74d9eead992e10b2d
SHA256 cb008e0a6c65ddb5f20ab96e65285dee874468df203faeafca5e9b4a9f2918dc
SHA512 b397508607a1c7ccef88c6a941398f78ba4f97cf8a32f40764673db34c20eea61364148260d87014348613eb07e959a043b505702437e33927249899bf4522b3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pywintypes37.dll

MD5 01cecd52afa068889bfaf34a18f1d638
SHA1 9ee9de2b2934bcc1012f7a173fffe5357bc31db8
SHA256 a80e2b9fcadac2cc74fda050f5c340dac8b87134bc75076c842d72f18ef5e07d
SHA512 1fb5f903d2d54ab3496c69eb09338f7f6466f65a7296e633898ba900994929d089d3206c7069c162d0b45f734734b62df60ba0abd2651564cd81e06f93a44af3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32api.pyd

MD5 c9962320edd20cf60c68d512f6ff10b5
SHA1 59f6adf0cc52b76a34a51670c09db8e448e514a1
SHA256 49fce87c3d17ec7d978a098a524d79750097877228b73c2d467f342fec55eef9
SHA512 460b16091410ea8f5e998b34ca438ae8083db33729936bbabe03b33a2af99c6f48370217e88b75e95d8ae8f67b972d38a67877b1d9bf5d39b3f4b37ce14d025b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pythoncom37.dll

MD5 38c2d81dcb36a50a2071f50ef031285f
SHA1 9ae08d9056f2e17ec5988366a762f9e9b9fc4c07
SHA256 c28c8fa1c48b2833f37c3c8d4853308baca95386041f311e8a23d15dd9450273
SHA512 ad122a1c8bf3a7a0ecdacec0f81b7f59b5d5cbd027aa9d4db511f1a685597f32c77e68c5b4e10b6c4ee7d79f7ca6fef785ee05ee82de113efc11375cb7d8c44e

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pythoncom37.dll

MD5 38c2d81dcb36a50a2071f50ef031285f
SHA1 9ae08d9056f2e17ec5988366a762f9e9b9fc4c07
SHA256 c28c8fa1c48b2833f37c3c8d4853308baca95386041f311e8a23d15dd9450273
SHA512 ad122a1c8bf3a7a0ecdacec0f81b7f59b5d5cbd027aa9d4db511f1a685597f32c77e68c5b4e10b6c4ee7d79f7ca6fef785ee05ee82de113efc11375cb7d8c44e

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pywintypes37.dll

MD5 01cecd52afa068889bfaf34a18f1d638
SHA1 9ee9de2b2934bcc1012f7a173fffe5357bc31db8
SHA256 a80e2b9fcadac2cc74fda050f5c340dac8b87134bc75076c842d72f18ef5e07d
SHA512 1fb5f903d2d54ab3496c69eb09338f7f6466f65a7296e633898ba900994929d089d3206c7069c162d0b45f734734b62df60ba0abd2651564cd81e06f93a44af3

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32api.pyd

MD5 c9962320edd20cf60c68d512f6ff10b5
SHA1 59f6adf0cc52b76a34a51670c09db8e448e514a1
SHA256 49fce87c3d17ec7d978a098a524d79750097877228b73c2d467f342fec55eef9
SHA512 460b16091410ea8f5e998b34ca438ae8083db33729936bbabe03b33a2af99c6f48370217e88b75e95d8ae8f67b972d38a67877b1d9bf5d39b3f4b37ce14d025b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32event.pyd

MD5 5a8da8d96fbaad2268356eb28246c993
SHA1 ce618167e0e4056b371a54151fb012ad217271f2
SHA256 a96f93d95c648b2868428a49e8ea62324c06019ee348edd5c91474e1b8b9bae8
SHA512 82a5dad9fc77e53301013d14518527a0f249214cd43b8fd1f688e3600eaa6bf422d6e443e2cdd8da6098b0e399732ca00b6f456696362879023e877332a62c45

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32event.pyd

MD5 5a8da8d96fbaad2268356eb28246c993
SHA1 ce618167e0e4056b371a54151fb012ad217271f2
SHA256 a96f93d95c648b2868428a49e8ea62324c06019ee348edd5c91474e1b8b9bae8
SHA512 82a5dad9fc77e53301013d14518527a0f249214cd43b8fd1f688e3600eaa6bf422d6e443e2cdd8da6098b0e399732ca00b6f456696362879023e877332a62c45

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32process.pyd

MD5 36698b97ae759a92eb2836ba61036e71
SHA1 a50c5b7c8216536ba59e6d103a0510ca289c48f3
SHA256 086c87b9f139b6ac5660fa62bf9980a210b0b3d63923a5f04e9fa2afb6686dd0
SHA512 2a5e2a54138d3f09c6f3b27db3978938ba32978700d963c921e4be45ad9150904b76c3d7cae318c93fdad697f691f5034b511d60d66facd28c6c7860db7617ff

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32process.pyd

MD5 36698b97ae759a92eb2836ba61036e71
SHA1 a50c5b7c8216536ba59e6d103a0510ca289c48f3
SHA256 086c87b9f139b6ac5660fa62bf9980a210b0b3d63923a5f04e9fa2afb6686dd0
SHA512 2a5e2a54138d3f09c6f3b27db3978938ba32978700d963c921e4be45ad9150904b76c3d7cae318c93fdad697f691f5034b511d60d66facd28c6c7860db7617ff

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_socket.pyd

MD5 b3af79bbfd7d5c5285660819792a3a9c
SHA1 1fa470b280ab5751889eaa7bdb7ba37ff1270a06
SHA256 eb6132b253c40d7c3e00b2bbb392a1573075f8bbc0b2d59e2b077d2cfe8b028c
SHA512 dac7da4cd493c0753d477da222c9b1e8c2486a4b6587c7cea45661192f2d51316b6e6f3951ffbbcb83952e51ab61cc79326beacb3d5e8637d13f2831e093f124

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_socket.pyd

MD5 b3af79bbfd7d5c5285660819792a3a9c
SHA1 1fa470b280ab5751889eaa7bdb7ba37ff1270a06
SHA256 eb6132b253c40d7c3e00b2bbb392a1573075f8bbc0b2d59e2b077d2cfe8b028c
SHA512 dac7da4cd493c0753d477da222c9b1e8c2486a4b6587c7cea45661192f2d51316b6e6f3951ffbbcb83952e51ab61cc79326beacb3d5e8637d13f2831e093f124

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\select.pyd

MD5 d3bf89184b94a4120f4f19f5bcd128d6
SHA1 c7f22bb0b957bd7103cf32f8958cfd2145eaa5b8
SHA256 568efdc33f1fcc1af1d030c75fccedc2d9b1fcbf49c239726e2cf49d47add902
SHA512 1da8ebf323d170c5e9f6bfbb738e60119ccc690a08234dd23f2d9c1a33519fd4ad154805b012cca3dc7565bee672d334ca877afe2b5211e2122dd6e1ce337971

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\select.pyd

MD5 d3bf89184b94a4120f4f19f5bcd128d6
SHA1 c7f22bb0b957bd7103cf32f8958cfd2145eaa5b8
SHA256 568efdc33f1fcc1af1d030c75fccedc2d9b1fcbf49c239726e2cf49d47add902
SHA512 1da8ebf323d170c5e9f6bfbb738e60119ccc690a08234dd23f2d9c1a33519fd4ad154805b012cca3dc7565bee672d334ca877afe2b5211e2122dd6e1ce337971

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32security.pyd

MD5 c6b8e37c499a647b5e116c66f338598c
SHA1 b3ae1c61da00bed9d75b20895bb55f47a051ae9e
SHA256 1a5c484d69b5cfe62b842a62743af22bdee76958b92d9905ca595dcdca5cd1d2
SHA512 d1f6f7fd3ffae7f7b5b70835ef810aba62a5f5e7a6d440b82de26b87e84308aaa6d011a04a79ff40db971db584b9481496436c60185cc13b691cb4dea85eed4f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_elementtree.pyd

MD5 390552274c5f71c7ebd1f343bb74446c
SHA1 e6285b1b7bb06126f9e61791175facca21c03fec
SHA256 d6c7ea93cdefe1973239a3dec0f49a1027e943f1de07e21ff378978cc6a438bc
SHA512 e2135848220f3d9ff36023b2121b6e7b52224fcafdf260530ade96a788f2f2a11a7179ae59986eb7f6e850c829cb8ced600e25a788344fa72e07773429fa1b43

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32service.pyd

MD5 1bac6fb26be3c233606ef95d7c90bcd2
SHA1 5b9ac7f2f036f6891431180c84e515597c4d642b
SHA256 d6ddeeb5ac1a262bc6ed6bf9214ccba9301b6029ea751c1441ab41d7f17e32fd
SHA512 6b8eab057fab5e0b35c6eb9430fc7317a038eba9bd9ab90f070876f642db9e3e2efc81db9d4df45279074a0f6dd9ad1f8a277323345901af4f2e5c3b291dd188

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32com\shell\shell.pyd

MD5 e245eddce99571c212f446a15234d9b4
SHA1 b49d86c3f3d87beb7e46750212732f8480de3cb9
SHA256 126e8fc3bf93a27928e62ce5f4e36bfe558ca4158f08b1232999fdf65263d024
SHA512 1fc76a361eadcc782cc5ace9967a853c0db7d9969638f0db725c8336a7e74847322453f6c730ccdd0ed16f18fdf99e9a4c159c95611b8175c300bcf51cd42416

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pyexpat.pyd

MD5 187cdd3e6152d56986bb523c3a0f7d3e
SHA1 aca59c23e4e4974c37378bc7a2f365467e25c245
SHA256 7f22b82bffb4bd87c8c5dc3357c25b5714264b46ce05f6dc8c1fc4c579dca5fd
SHA512 c0612fb2f5d560055ffb3ec239dd4a8b06edece59e1c35af2da0e5d142643e6fc22ff4f1255cd620092d59958f758b790331163869480aa416026c374193c952

C:\Users\Admin\AppData\Local\Temp\crtdef.cfg

MD5 a392e4ed7d2681f713f1b634931b0925
SHA1 fce72390e7933c86332666d9800ad1c8c6f0fdb4
SHA256 5d9257920c7d5101ea1c52364b40968b8b90a8c94ae20f10de087a1fc855ab96
SHA512 05065dba29acb79cdd8e781c0aa578175e3a22ee0a5d03f2de86f7637e4499541763a4dc292cfad25e039674c12f22d1a69ba02b0af2aa1b9e00f793ae14c935

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\pyexpat.pyd

MD5 187cdd3e6152d56986bb523c3a0f7d3e
SHA1 aca59c23e4e4974c37378bc7a2f365467e25c245
SHA256 7f22b82bffb4bd87c8c5dc3357c25b5714264b46ce05f6dc8c1fc4c579dca5fd
SHA512 c0612fb2f5d560055ffb3ec239dd4a8b06edece59e1c35af2da0e5d142643e6fc22ff4f1255cd620092d59958f758b790331163869480aa416026c374193c952

C:\Users\Admin\AppData\Local\Temp\avremove.log

MD5 da8e91dcaa9a94f288a0206631bf02ec
SHA1 49c8261f69bf1e83898d6f417a2d97cc1edfb57a
SHA256 455bc4ee2908beb9e2d4d32289ca10530f4e129aa91966ed3ea108e960b3176d
SHA512 7f13b855be6dd96c35d98e1ed105a6680fa02f068526c7f7600a541c8429ff1582fb51eaa4da68128fdf5f99c322f5f90b1c6827ee8def8fcb9a789b0aa2f6e2

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_elementtree.pyd

MD5 390552274c5f71c7ebd1f343bb74446c
SHA1 e6285b1b7bb06126f9e61791175facca21c03fec
SHA256 d6c7ea93cdefe1973239a3dec0f49a1027e943f1de07e21ff378978cc6a438bc
SHA512 e2135848220f3d9ff36023b2121b6e7b52224fcafdf260530ade96a788f2f2a11a7179ae59986eb7f6e850c829cb8ced600e25a788344fa72e07773429fa1b43

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32service.pyd

MD5 1bac6fb26be3c233606ef95d7c90bcd2
SHA1 5b9ac7f2f036f6891431180c84e515597c4d642b
SHA256 d6ddeeb5ac1a262bc6ed6bf9214ccba9301b6029ea751c1441ab41d7f17e32fd
SHA512 6b8eab057fab5e0b35c6eb9430fc7317a038eba9bd9ab90f070876f642db9e3e2efc81db9d4df45279074a0f6dd9ad1f8a277323345901af4f2e5c3b291dd188

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32security.pyd

MD5 c6b8e37c499a647b5e116c66f338598c
SHA1 b3ae1c61da00bed9d75b20895bb55f47a051ae9e
SHA256 1a5c484d69b5cfe62b842a62743af22bdee76958b92d9905ca595dcdca5cd1d2
SHA512 d1f6f7fd3ffae7f7b5b70835ef810aba62a5f5e7a6d440b82de26b87e84308aaa6d011a04a79ff40db971db584b9481496436c60185cc13b691cb4dea85eed4f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-console-l1-1-0.dll

MD5 37da7f6961082dd96a537235dd89b114
SHA1 daa1e2e683fa0512ff68eb686d80b4aa3b42e5b6
SHA256 6ee46c6b6727eb77bcbcdd54dc506680ca34af7bc7ca433b77775de90358844e
SHA512 af4f28e3319344d2e215f56026e9cee5c951b5c44374c7eeea6790d18f174d7e785ceacbbf1450d5ca1d76f207b5f7b4f24674468f30be84c6c3e90c48ce2a2c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-datetime-l1-1-0.dll

MD5 3b3bd0ad4fea16ab58fcaeae4629879c
SHA1 eb175f53640fb8ac4028a7657bbf48823a535677
SHA256 dcb9cf7e31d6772434c683353a1514f10d87d39feaa9b3edf3fa983b2988294c
SHA512 f206e7f56a218a1725f212b20416210c228e60d0d3c44f9a598c93acb10bf8a3c961b4c4d104ae0f166598be5c5102a1ff77a39d2b70743e784f69c82fd4c730

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-debug-l1-1-0.dll

MD5 584766df684b2ad2a3a5b05a5b457fac
SHA1 c207b7aedb8d978c8320a1454331519a8365f20d
SHA256 b15964d49a2c5219e0923137aa9028611be81fdbdcbb0d43bb3aaa23114e401f
SHA512 3bc7d49f997e489466858a21daa22b397adb8e736d7e064542ed5f73cd87b52cbd412cdec2b4b892f9231c2562e24c8debab73054e878405f2b2a022e86d26b8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 906cb0c8aba8342d552b0f37ddfd475f
SHA1 a3cd528b9c212fea97495a557a91d638b1608418
SHA256 582e87ade6dac258844154b068c291ff8d8f6d7ab6ee029fcd3cf1391874c74b
SHA512 27b33658a30010e0c6a09f5b1359a9e39871b7851d0cfb43f5e2063fb77dafb34df9724fce82fc7826463104fee0820ae4e996a76dd3912490689686ea05844b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-file-l1-1-0.dll

MD5 779a8b14c22e463ea535cbca9ea84d49
SHA1 4620531d5291878c10d6e3974f240b98bc7fb4b9
SHA256 fc0551de11b310dfd8f3fc924f309d5e754b547ffc475cf6c3d007bb5366f148
SHA512 08882528df66fc582a890ad64c7f96e8f9de56d4871a4d9b6b32e1c3ffb0c29b425f4cc893b2575f6697ffafbb56ba84d43d602483b0470488df823d445b84e4

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-file-l1-2-0.dll

MD5 f6d1216e974fb76585fd350ebdc30648
SHA1 f8f73aa038e49d9fcf3bd05a30dc2e8cbbe54a7c
SHA256 348b70e57ae0329ac40ac3d866b8e896b0b8fef7e8809a09566f33af55d33271
SHA512 756ee21ba895179a5b6836b75aeefb75389b0fe4ae2aaff9ed84f33075094663117133c810ab2e697ec04eaffd54ff03efa3b9344e467a847acea9f732935843

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-heap-l1-1-0.dll

MD5 1cd8672d8c08b39560a9d5518836493e
SHA1 c7ce2330265d07d88ad15f80dd88473f3daafcd0
SHA256 4a5f33a0837a9d9f22d49ee6d062bae671a4c5c5522db6ffe03c1aa2c0bd008e
SHA512 6bce6ef09746c10e3b3f136bb2ce67002f27ff70c3fcba48e7f1c3769000a62649a41fd82acbe2a819b8ece96d8e9399b15104ca2b40f65b51a0c84fc2a7901c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 44ca070dc5c09ff8588cf6cdcb64e7a2
SHA1 63d1da68cd984532217beacc21b868b46ec5d910
SHA256 edeb5b3003db4ee3767fa012e812323fadef67663c1b45fed3fca96cad5aecc8
SHA512 c3a214550993a56907aa35091112f9f89e0a74375a7c268133a7c06d88e5de4f9c87f7e0be5007f00081a772df724590d38966ed465f92217d3ef2f45a29c237

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-interlocked-l1-1-0.dll

MD5 b8bb783dee4ea95576882625c365e616
SHA1 e9af4b17fc082b5d717bfa013d46da4bdffb2cd3
SHA256 21bd55b9d42a5faa5fa3c5dd9fad1665df3c33557cc4f7a58248a88b69d372b8
SHA512 b756468dcf7254fd31d3650f794b837724a82207001b521105be05df4cf187785897be8377083c53a92c0dc5aee2cdaf8b9538fd6944e0ac4be5d286836037a1

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-handle-l1-1-0.dll

MD5 fc68978abb44e572dfe637b7dd3d615f
SHA1 47d0f1bd5195ce10c5ec06bdb92e85dda21cdab3
SHA256 df6bed7bcccaf7298133df99e497fa70da761be99c2a5b2742cfc835bf62d356
SHA512 7eb601d7482dddc251898d7efbdfe003bab460af13b3cb12f1d79fdf9d9d26fc9048fd8ca9969b68bbe5547fdcd16f59d980527a5b73b02da145419834234873

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-file-l2-1-0.dll

MD5 bfb08fb09e8d68673f2f0213c59e2b97
SHA1 e1e5ff4e7dd1c902afbe195d3e9fd2a7d4a539f2
SHA256 6d5881719e9599bf10a4193c8e2ded2a38c10de0ba8904f48c67f2da6e84ed3e
SHA512 e4f33306f3d06ea5c8e539ebdb6926d5f818234f481ff4605a9d5698ae8f2afdf79f194acd0e55ac963383b78bb4c9311ee97f3a188e12fbf2ee13b35d409900

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-localization-l1-2-0.dll

MD5 3b9d034ca8a0345bc8f248927a86bf22
SHA1 95faf5007daf8ba712a5d17f865f0e7938da662b
SHA256 a7ac7ece5e626c0b4e32c13299e9a44c8c380c8981ce4965cbe4c83759d2f52d
SHA512 04f0830878e0166ffd1220536592d0d7ec8aacd3f04340a8d91df24d728f34fbbd559432e5c35f256d231afe0ae926139d7503107cea09bfd720ad65e19d1cdc

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-memory-l1-1-0.dll

MD5 fc13f11a2458879b23c87b29c2bad934
SHA1 68b15cc21f5541dc2226e9e967e08af81d04a537
SHA256 624841916513409c3cfcf45589eb96548c77b829e5d56a5783249d3ab7dc8998
SHA512 801a23485e42cc224e508212e7114e89747543a20964cf666ee801fcc2fea97888faa1af8da2af807c50187969a08c6fce2a021836811786ef72f4c2bdbde33c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 39556e904fa2405abaf27231da8ef9e5
SHA1 89db01b04dfdbe5c0f5e856050611a6a72f1afd0
SHA256 5f476627a904b182d9b3f142594defa267db3ce8206bac24af063a29635b3a8b
SHA512 558c0d0dd0ce24c7dcdebae64578e09acc36a86b6f121266a147394dd9e8f8b2b81726b9ccc24ed07755950cd13c1d34cab137e995d0be25ebf52699d0fbb6b6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 07954af744363f9807355e4e9408df45
SHA1 b37d06b39eb7186b55ceae25427b7ab95e46e32f
SHA256 4b20aaf0e3b7566b797652f8d84b749ab23f7d1557dba882c0590fe1be98ced6
SHA512 b7a7c16ef8be62d9f562dcecf01b2ad1c066de92aa4ca7a8c7bb93a80b1bc781f8a6a47f51a252e40337bd8d7778cacfee7488a5fad15f11d24c90572ad0e4c6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-processthreads-l1-1-0.dll

MD5 39047e168ffbdd19185504633d6eca29
SHA1 fe3423689efedada19c7dec3d5dd077a057bf379
SHA256 611b3e36ad3e0045ab4170a5d4e2d05fd2a26dde2f7b09ea51f4264e263a544b
SHA512 8b7d38726e302cdcf5a296e50ccc969b2b122432b93e2b5d1d1f4c1b6c2b3a9b64af79bb65a7a9eac31f563ae60934458f9316dd5cbb071fb0a3ad180fac6103

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-processthreads-l1-1-1.dll

MD5 c2ead5fcce95a04d31810768a3d44d57
SHA1 96e791b4d217b3612b0263e8df2f00009d5af8d8
SHA256 42a9a3d8a4a7c82cb6ec42c62d3a522daa95beb01ecb776aac2bfd4aa1e58d62
SHA512 c90048481d8f0a5eda2eb6e7703b5a064f481bb7d8c78970408b374cb82e89febc2e36633f1f3e28323fb633d6a95aa1050a626cb0cb5ec62e9010491aae91f4

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-profile-l1-1-0.dll

MD5 7697f94ed76b22d83d677b999edfc2e1
SHA1 42afb5b8e76b8b77d845156b7124cc3e0c613f91
SHA256 50fd585270fa79fd056ec04b6991d0e65cca28c1116834a59d5591f8d8c2c214
SHA512 1ef120baa532692d22f8939d9f149035e38da6b65b889ba6ccb7858596718d569b0b9b35ad3609de9daf229553254966bf3d5a6abc4af1ff56732ce8560b31c8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 fdf0b4bf0214585e18ee2f6978f985b0
SHA1 0fe247f8cca0c04729135ee612fbfced92d59d9d
SHA256 cf42c1215695579ade1842246ec43da9a9b28e8107957c0c340ce3ba9f689584
SHA512 d0a249c230520538e8c2759cc0a41444c543dabd6347c8a8231c587ebba28905ad2df5e5d6437881c7a02f6de6212a719acca2f6d30f63f8d7a21a26921a1807

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-string-l1-1-0.dll

MD5 687533a89b43510cce4d8b2ecb261aa0
SHA1 4004ba63880a92042c106ff6a549c6f5f69ce05d
SHA256 e7272ff3b00508732896bf96f8dab5ad32fe4531746ab1c228c315f1b4d48156
SHA512 6a61dd13939bf61342278effa07d2654219032f9523d3d552275bd60bd3b125dad13737924d33f6619c5a7ccace008b37c3330451411d3bd09e1d2b5064f9aac

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-synch-l1-1-0.dll

MD5 88c4ca509c947509e123f22e5f077639
SHA1 ae837c556ff23b9e166288a11e409d21bddda4ed
SHA256 0787fd3d9606b8614f9073c5f04cc6cb153bbf2992297cebb8c537c066a78c9f
SHA512 3cce8c4ea63019adc6383d5da7f5969b0b10a55ceef29083e21f04d23377305325c5cb5f4656955f8abb5a1e10beeac60808de9d03a72462950469ae49768418

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-synch-l1-2-0.dll

MD5 f6b4d8d403d22eb87a60bf6e4a3e7041
SHA1 b51a63f258b57527549d5331c405eacc77969433
SHA256 25687e95b65d0521f8c737df301bf90db8940e1c0758bb6ea5c217cf7d2f2270
SHA512 1acd8f7bc5d3ae1db46824b3a5548b33e56c9bac81dcd2e7d90fdbd1d3dd76f93cdf4d52a5f316728f92e623f73bc2ccd0bc505a259dff20c1a5a2eb2f12e41b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 b9ea058418be64f85b0ff62341f7099e
SHA1 0b37e86267d0c6782e18f734b710817b8b03da76
SHA256 653be79fa676d052cce60d743282018faaaf22e15a3cb8f1eee01f243d56b431
SHA512 efaac54c0c6648f666b58e0441315446fdbcb8544c3b9e2005482de25e62e716d0c66dcb7a9cedd7967ffc26e394ae9f1b1dfdce1d4243cfde737140d1c3d51d

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-timezone-l1-1-0.dll

MD5 a20084f41b3f1c549d6625c790b72268
SHA1 e3669b8d89402a047bfbf9775d18438b0d95437e
SHA256 0fa42237fd1140fd125c6edb728d4c70ad0276c72fa96c2faabf7f429fa7e8f1
SHA512 ddf294a47dd80b3abfb3a0d82bc5f2b510d3734439f5a25da609edbbd9241ed78045114d011925d61c3d80b1ccd0283471b1dad4cf16e2194e9bc22e8abf278f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-core-util-l1-1-0.dll

MD5 2886c75f8b9d3efdf315c44b52847aee
SHA1 4fc75e39493b356f1f219798e3738dbc764281e4
SHA256 3db27d95689f936b4591ebad18173ad07fac07d69d68eeff06dee158599d731f
SHA512 2931224106eeea142664aec9d1d5d028d15a14765bce8674d34d67fc027f6feff3af283f3d81b113e6efcd42e6b4bd249e94e01c8f41b5211650f1775774b765

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-conio-l1-1-0.dll

MD5 3b038338c1eb179d8eee3883cf42bc3e
SHA1 ea97cf2ee16ef2df3766a40c6ce33c8be5f683b2
SHA256 c17786e9031062f56e4b205f394a795e11ef9367b922763ddf391f2acab2e979
SHA512 1a6d8fc065237bf0dbba18c777958522697b6bc2be1b16586870a0c06178d65b521f66f522bf5636df793e4ac8a2a3de780b3c7062273a11f52a381ee851ece6

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-convert-l1-1-0.dll

MD5 5245f303e96166b8e625dd0a97e2d66a
SHA1 1c9ed748763f1ff5b14b8c791a4c29de753a96ab
SHA256 90a63611d9169a8cd7d030cd2b107b6e290e50e2beba6fa640a7497a8599aff5
SHA512 af51f341670f925449e69c4b5f0a82f4fc4eb32913943272c32e3f3f18ee43b4afb78c0d7d2f965c1abe6a0f3a368616dd7a4fb74d83d22d1b69b405aef1e043

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-environment-l1-1-0.dll

MD5 45c54a21261180410091cefb23f6a5ae
SHA1 80eee466d086d30c61eaefc559d57e5e64f56f61
SHA256 2b0fea07db507b7266346eab3ca7ede3821876aadc519daf059b130b85640918
SHA512 4962f85c94162fe2e35979fff4e4b3752f322c61d801419769916f5e3a0e0c406284d95c22709c690212d4572eb688d9311a8f85f17c4f5d1a5a9f00e732808c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 ab8734c2328a46e7e9583befeb7085a2
SHA1 b4686f07d1217c77eb013153e6ff55b34be0af65
SHA256 921b7cf74744c4336f976db6750921b2a0960e8aa11268457f5ed27c0e13b2c8
SHA512 fd7e828f842deabf2dcdcea3e947dc3aa909c0b6a35c75fd64edc63c359ab97020876e6c59ad335a2a166437fa65f57433f86c1c2fe10a34b90d15d8592fe911

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-heap-l1-1-0.dll

MD5 39d81596a7308e978d67ad6fdccdd331
SHA1 a0b2d43dd1c27d8244d11495e16d9f4f889e34c4
SHA256 3d109fd01f6684414d8a1d0d2f5e6c5b4e24de952a0695884744a6cbd44a8ec7
SHA512 0ef6578de4e6ba55eda64691892d114e154d288c419d05d6cff0ef4240118c20a4ce7f4174eec1a33397c6cd0135d13798dc91cc97416351775f9abf60fcae76

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-locale-l1-1-0.dll

MD5 e70d8fe9d21841202b4fd1cf55d37ac5
SHA1 fa62fb609d15c8ad3b5a12618bcc50f0d95cdea3
SHA256 e087f611b3659151dfb674728202944a7c0fe71710f280840e00a5c4b640632d
SHA512 bd38bdf80defd4548580e7973d89ed29e1edd401f202c367a3ba0020678206da3acc9b4436c9a122e4efc32e80dbb39eb9bf08587e4febc8f14ec86a8993bcc8

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-math-l1-1-0.dll

MD5 d0d380af839124368a96d6aa82c7c8ae
SHA1 e2ac42f829085e0e5beea29fcff09e467810a777
SHA256 06985d00bf4985024e95442702bbdb53c2127e99f16440424f3380a88883f1a5
SHA512 daf3997922e18c0be088a15209c9f01cc1dda90972a6aadcf76de867b85d34483ad5e138e3fa321c7140bf8e455c2b908d0a4db6a9e35011786398656b886479

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 809bc1010eaf714cd095189af236ce2f
SHA1 10dbc383f7c49de17fc50e830e3cb494cc873dd1
SHA256 b52f2b9de19d12b0e727e13e3dde93009e487bfb2dd97fd23952c7080949d97e
SHA512 f72ec10a0005e7023187ef6ccedf2af81d16174e628369fb834af78e4ef2f3d44bf8b70e9b894abc6791d7b9720c62c52a697ff0ade0edddcaa52b6f14630d1d

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-process-l1-1-0.dll

MD5 8f8a47617dfd829a63e3ec4aff2718d9
SHA1 1d7dc26bb9c78c4499514fb3529b3478aecf7340
SHA256 6d4a1aad695a3451c2d3f564c7cc8d37192cd35539874df6ae55e24847e51784
SHA512 d3b96b1f80c20de58a4d4179177e1c1c2b460719968fba42e1ba694d890342aaab5a8c67e7ffdd126b2fc6d6a7b2408952279d8926b14bf2df11740483867821

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-runtime-l1-1-0.dll

MD5 ae3fa6bf777b0429b825fb6b028f8a48
SHA1 b53dbfdb7c8deaa9a05381f5ac2e596830039838
SHA256 66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb
SHA512 1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-stdio-l1-1-0.dll

MD5 32d7b95b1bce23db9fbd0578053ba87f
SHA1 7e14a34ac667a087f66d576c65cd6fe6c1dfdd34
SHA256 104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728
SHA512 7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-string-l1-1-0.dll

MD5 5e72659b38a2977984bbc23ed274f007
SHA1 ea622d608cc942bdb0fad118c8060b60b2e985c9
SHA256 44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea
SHA512 ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-time-l1-1-0.dll

MD5 1fa7c2b81cdfd7ace42a2a9a0781c946
SHA1 f5b7117d18a7335228829447e3eccc7b806ef478
SHA256 cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd
SHA512 339cdaf8de445cf05bc201400d65bb9037ea7a3782ba76864842adb6fbe5445d06863227dd774ab50e6f582b75886b302d5dd152aff1825cf90e4f252398ace0

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\api-ms-win-crt-utility-l1-1-0.dll

MD5 d6abf5c056d80592f8e2439e195d61ac
SHA1 33f793fd6a28673e766ad11ee1cf8eb8ef351bc0
SHA256 8858d883d180cea63e3bf4a3f5bc9e0f9fa16c9a35a84c4efe65308cea13a364
SHA512 6678f17f2274aabba5279ba40a0159ff8a54241d811845a48d845172f4aa6f7397cfd07bf2368299a613df1f3ff12e06c0e62c26683dfb08d82122609c3a3f62

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\AVRemove.exe

MD5 56c7781e35e6ce6ba43e58e56e827a20
SHA1 127224517f0163ad55f50feaf7e92c5de79cd2d0
SHA256 69b50a7ec8e50663214f07d03e2496a20a433afd8fea3f75141f4bf4b822de12
SHA512 5a08a4e293779cc873c0b857d19db0ea70480ad1b3e6f88894ed3dbbd147898f3e1cbb4d61ad53c515db90ce241de6d250654f302c361e853e6d111cd8f655ac

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\AVRemove.exe.manifest

MD5 576428ea1aad9e1ff3979cf0cd99e7b3
SHA1 f1f052d6411f3a77be3469ecf143040d2737940f
SHA256 69e356cb2d3080efcb19d2ae513b9071a7c09536aae740ef59bf96a79742ad7b
SHA512 8b295f3eaae95d8909ce42851e54b1c6a8d3bd0543d49b0da06952b3859cf4e460e55a2ce484105e52fbaa6ac920bdf83a00c27d013771919569431246db3cb5

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\AVRemoveW.exe.manifest

MD5 d61bf385dac2baf407c6316550ae814a
SHA1 55e26299261876f5e502bc3845fad0258e4685b6
SHA256 a1c72a553e502d89d27bd6e42b2b2cb42aa56720387e750606bc09d00c2913f5
SHA512 f37c2825d2e39a6517f6897560f504f80e71cf3b89bbca2306bac282407a1d0c81e26cc8c07c79704827b891d18a5aba04fc59b77e947b6872ce8ca0eacb142f

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\libssl-1_1.dll

MD5 697766aba55f44bbd896cbd091a72b55
SHA1 d36492be46ea63ce784e4c1b0103ba21214a76fb
SHA256 44a228b3646eb3575abd5cbcb079e018de11ca6b838a29e4391893de69e0cf4b
SHA512 206957347540f1356d805bf4a2d062927e190481aadc105c3012e69623149850a846503fca30fc38298f74d7f8f69761fddd0aa7f5e31fedb1fa5e5c9de56e9d

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\mfc140u.dll

MD5 ec85d7a09109d1f52f165cfba6db8b33
SHA1 bcc0a43bea8e4d0db781f417cc2faefbb034bd36
SHA256 cfba55b3d6891a0f9e90726094dc4e57553c3443cef156e5ffcd5965ac4e8e3f
SHA512 446b9b56b89730dcb891701c28d8b2c6666a924c0a908fdea386e139a6392afd7b69fd4bf5dbc20308baed7897fda23777798fdf2b10291f954eed10935cfb8b

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\perfmon.pyd

MD5 b6864d51bc85ff6234122baacb5d793d
SHA1 c9641baeea8a61abb1740329a0ef9f0618ea273d
SHA256 a7a854474b046a15a15d1cb1c4baff9c3b280039845c2c5f8352bef763d215c4
SHA512 ebd40880a1a5052995eb42be913438fffb7fa5f4df5256fd28a704525e75f067cd6a2869d3fd16f3741cfa88d15cb9130a9fef1f5be2719e8495348cec145eee

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\manifest.dat

MD5 066bcef117520e1024a9554d40d4730f
SHA1 5786822120530ba275ca501302ec0aa5763fea5f
SHA256 89b0e70f6047fc4751085a5f09ea548a4b69f32e37d962660358021def54bf7e
SHA512 aab9f446c4ed87f3bbe7e71892a196c390d15c5975c5e713d3117c56c62d899e83ae2a88235a462d8efc22365e4f9454e60ee27d577a13f7ea32d40c5b7193a0

C:\ProgramData\Sophos\AutoUpdate\Cache\installed\crt\crt\license_agreements.txt

MD5 6f3affd27ab92d0d16f2c917ee7bcb6f
SHA1 561788b51e73691bafc71f6074a51f31525691a9
SHA256 66637204703c92a3ee1f2c5d12fb2b755e06056dc35ffdbe6d2b11062265cb7a
SHA512 9cbfadd178b77a615fe8cec2d5b46afcad35997d36aba552ebc315a6ee9afcb8066c5c3ed24fb42cae285150fc40fd0c32bcfeb565782a63db0b1d2fb3bddd8a

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\servicemanager.pyd

MD5 ed09cb96b22563d0b97974700e00a55b
SHA1 3e8586771374abd76eb73a1335899dddce8c5080
SHA256 df506729a87bfb5f9d3eb4a67cbc85cd07447f500020c19dc2a7eb8035df5458
SHA512 acc1db9ff098fbc1612dc7f163159a11a57fd89e6659d53e13f0a77f96ab8e4f16420247f7956f0e45c5c322da24ad12bccbcd746772b1e969f7667b9fe8b768

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\unicodedata.pyd

MD5 22ee48112415ee74c80b66cc1a8e1ca8
SHA1 9eb11b06ba0ea22a2f339d0ce300f45f48607d4c
SHA256 8f38b8891c74da4af150b60d21053cda95a61881c61b8fff1c8852885de8b2af
SHA512 080da19fcbfcfdd55bccf231f6f4820204707ae3a08de7e40ce8e1f87df1edd916fd55a37e6560c1e1a6935ddc42d47dce82aa834a8287b024d907cc9b98b3ce

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\ucrtbase.dll

MD5 3e0303f978818e5c944f5485792696fd
SHA1 3b6e3ea9f5a6bbdeda20d68b84e4b51dc48deb1d
SHA256 7041885b2a8300bf12a46510228ce8d103d74e83b1baf696b84ff3e5ab785dd1
SHA512 c2874029bd269e6b9f7000c48d0710c52664c44e91c3086df366c3456b8bce0ed4d7e5bcfe4bdd3d03b11b8245c65f4b848b6dc58e6ea7b1de9b3ca2fb3348bc

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32evtlog.pyd

MD5 b02e900678619882862bd8fc2f36f020
SHA1 1d93125c12ec2498eee3a123416292d3266bb181
SHA256 0418aafaad9b4faa8aa598f67cc9f48a069c4d03a0a1f755062f694714534b94
SHA512 d108c6a5883e8a958185f84fa25a984ad89611160f45f7f579e20d36baff2f40c512d14ed63e37b5ce180073d33a2dbee23b0ecabfe30faaf180ecac3076c83c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32trace.pyd

MD5 4dd15b85d315a76fbe02f318308e5168
SHA1 9bd247048cb4877cc069a69599fc03a86f510664
SHA256 cb57a2999949d0225452151c47abdd8bf9ce6061c0c3fdf9b7ba9b256f49adc6
SHA512 eaf7e406ad84d29de66323728c298ed3d3936305b1febf267bfe913329a932706083395aaf68a7b82fb2c9a220a6b6cde6691b8af7fa52624a363c6454073e28

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32ui.pyd

MD5 638f290d870eef6d90a68334ed974639
SHA1 5998f4d148a2bdd81f6f8f7d00e5e678342d1e38
SHA256 cddcc5344facc6515fb2ecfeadffb3f29629ec684eb9b17ab8e777427c34b7ff
SHA512 08bf0ead0dc9c47423582313382ec21e6cc03d34002d95f5ad5eeef6c13f054b4fcabcc6e90a1fcc41e38c902fd29771e276f0b0d0511500e1c7952ac88a64a2

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\win32wnet.pyd

MD5 3054ba93f1c587866a10d0223bb5005c
SHA1 5b5bab769fa02e33d63b0f4d0071fd6a8d007eda
SHA256 3fa330895f58cf71a6b555be92619cedc22ead295fc864da90bee065e55ad530
SHA512 ab34e27b228289b85aaa885cb388081e5ef5a69988a2d4e1272e4833a991cf901809d92c080596cc3c20986003dac49ae2990fce3111771eeaf6d1d366fb5fee

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_ssl.pyd

MD5 2825bae93cd459d835b74892c9bd80db
SHA1 c7ab0c88489e5eb8e920ebc9871c969768bd4739
SHA256 af4379fdc8bd41f7a8a4b509de949202ccdb5e4825797d7a5dddd5e77671382c
SHA512 fe5d9c3ff4469647afd20ffa43ebfdada0516576117c51d03eb8960a81516425fd110e2f6978cf98d279e3912c2a9c1d42c4c39900e183b1f08c2272eceb00b7

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\crt\_win32sysloader.pyd

MD5 d2122c6ee0baa78c677d5eee4e51e800
SHA1 9d3072009ee36bc0c85aa91e81b9e88d337ac248
SHA256 47403a13326afe3eb42da6a1b82b9b815940fdb92d9b9df56e71a666e4e5186b
SHA512 71bd6125d49124b3069f88df202040f0347d2c1c6e683d2c068e52c9f5725ca1ee3cccbe07314628df13c5f7f597f7c7a579b226bfcf4a2412e297699f4219b5

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\crt\manifest.dat

MD5 eb26f62affbcd5bf42e9f33b75cff89f
SHA1 0af6cd484606cf0705a152b9fb2bc96677440819
SHA256 98e58090818e8e688a23e2156a181b93928bfa9e6a10dd9f8f1fa724a0932aeb
SHA512 be21687e1bd689b7dd92bdc1cb2f72ca1f64c3440eae253c8245317f6ee030a122ac03e3fb352b8a763097c5f1d4fc9b5c53a6715b660e74bc6d1fad1a01ff4c

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\version

MD5 61c4bcdb39102243ef4b6081de0e4d24
SHA1 c123b7df621c7545dca496d59b4fecab46187cd6
SHA256 095c875b5c9bc168ea9a143f26997d0a078a1e236d599d2fb9ec133867e66e6f
SHA512 a5dcb53d92c56ac41c68ed0aace2c82e4593d462ec00a48a3796b561ada107e69c62549cc814a054a4aed815e446106ddb6cb0c5bf0dc1c821e04c26c3ee1f16

C:\Program Files\Sophos\Sophos Endpoint Agent\integrity.dat

MD5 bbfa4dee32f434e66ae52c9d951af118
SHA1 8dfe8b0eef24c33ab97a287dad1dcff5d39ea647
SHA256 b908db2711775e280c9250fd78534b9702ddae17efec3e45a16c8889511b48a2
SHA512 afd2c460d19f8cac97742bfa333a7682ab072441d34fe5456fefa6fa95ee7d8de157067a7cf285726eee3aeac1ef62be7912181d9f115dfa80287fbfe252e821

C:\Program Files\Sophos\Sophos Endpoint Agent\deleter.dll

MD5 0ab5daf7a104f31619c84d61bb7f80d6
SHA1 321ffeed63969a1c7ddd12a989432d7645fedeb6
SHA256 2076753cafeb787a743701b10297b16bf1812050e443896305010507fdcd46f1
SHA512 c5e044e218f07c9ea4c6226c9f24c55c9237b9ac68bcc34000e04e23f2e108fdb1371868afb79c0a7211f9e61ba6d3666a41bf0262dfb44e6c3367694057c223

C:\Program Files\Sophos\Sophos Endpoint Agent\SophosUninstall.exe

MD5 528ce4597227e6a94904ac2b36502e91
SHA1 335f65793c1fa96efde8b139b468d2e2ce03e8e1
SHA256 7621d58911e96127c33da54fdf746a473bc5553db5202ba46959c5d492dee055
SHA512 2288a46f24c182a2f1084272e5f01afa3af24e420d268c0f73e305be6716ed26e995a8fe7ded7433d3964765c1b7a1e02588deaf1cd4fb5f1ea7256b608aa3eb

C:\ProgramData\Sophos\CloudInstaller\AutoUpdatePreparation\Cache\decoded\uninstaller64\manifest.dat

MD5 d9600e8530744e4dedbbf4027a9bcc77
SHA1 7bf8830008fc4bc5436c93c3c46fad094e4c9a76
SHA256 c862c9dcb8a3c2835d6980fe35be3844a5219d2c8d9c8a285cd5a8075ed555a9
SHA512 ade77be4a696cdf31ad27118e1e8681488933f35506fe9bfbe5664db6901d51ca26a5f67af7dae8685d37c32368757e70b85ab9a29a5fc699bc07381e10a5603

C:\Users\Admin\AppData\Local\Temp\Sophos Endpoint Defense Setup 3.1.2 4-10-2023 1_30_18 PM.log

MD5 40dbd958e4f04f0beae30893d37cec4b
SHA1 ab1967acf4629b97d34eda7ae0f443992e78ab2c
SHA256 b89c11b19647c0e4b24ef397fcf5b10c1412c7d24f6b5be1b513b363302df073
SHA512 a6a89f52b6b93b7f222f01e46258543954278136c9654ddf67926592b7557fe4d896f36a055728ba6f8cf3f27ab581c5ce11b8692f89f892402366fdb1019538

C:\Program Files\Sophos\Endpoint Defense\CoreEndpointAdapter.dll

MD5 1a9b077a2f8be97cb166bae98c2e038a
SHA1 18819b804bf940dca45da118a7caf18161fea803
SHA256 d5472989ca892b6b586987deeee46b832d855d3995b7744a9485ad328c380608
SHA512 7daefaa70227ae7e0a3adf5223ebe4010efb029e74a7a91cfdc0239587b1963eb64019cd13d5f2a79e204a1c367a8369df33680d9c20e62398daeaf589114de1

C:\Program Files\Sophos\Endpoint Defense\CoreCustomerAdapter.dll

MD5 760664fb23d6a0bb40478d6971baadf6
SHA1 7162a2cba986d55099dbf2d68ba4d1d498ee7832
SHA256 08144b473e040f6e205c38556e08fe5e17661ec44d6d0b1fe2827f3cb21aa892
SHA512 168478991c8d82ba7b2b16a162e581b69f84c074f95af205c31562816bbe1c81b68fcc9bb575a504413a18f3004b91ba51b1879e658fbbb54b98985f20b2c5a3

C:\ProgramData\Sophos\Endpoint Defense\Data\AppFeed\1681133418\appfeed_part_0001.dat

MD5 bfdb5a622df34d284916adbc865703d2
SHA1 633f85851cbe272112413d6ea8790bf83fbbeee5
SHA256 1049e90a410fcdef279b2307e728c7dd882eeb8e5829763b9bbff111ad883983
SHA512 febc4899160b080af7ff4fa6ac9a079f5959d5f8b9c2ddc5e3f7910b55f695051d366a53c2b3e8f6c167dc1ba3f91d37080da2d7b254aab08306a72d3fcb8349

C:\Program Files\Sophos\Endpoint Defense\NOTICE.txt

MD5 d2cb28c12e7cb5cc1e5842ebdf72b40d
SHA1 27c25d195ce4ac9a45be2855812b9fc053013490
SHA256 b58f589c31cfc433f0dbdd591f743c0a6485894c5d7682207cc6836ad59a79c2
SHA512 f0cb1684f627c8410beddb6c9cfbcbb671005e0ca6144d805dbba3536bbc0a5bb0997d10d69028af49cc17ab541e3b66f1452dc8a5705becfd75a1f4da805d39

C:\Program Files\Sophos\Endpoint Defense\public.pem

MD5 c713df70875de8d2574d114e7082245e
SHA1 9337fe777c3eeb16fa79acb10a7abfc56252b571
SHA256 5a9d8b867dfbe015b76befed4d2677f086d718c68640dd0ae2cbc0e43e49f934
SHA512 b18cfb6625eec2f2415ee36f2fb1a3c5596658692f4237c9eef368573e26b5dc4eb5e2172066d8838cc7e7275477c28e417b66cd420e73f58a0c816316416a2f

C:\Program Files\Sophos\Endpoint Defense\safestore64.dll

MD5 aaee62595949134ecc929da47d54e708
SHA1 1eebfc190f5058b612c75477458d24fc7bf7b22a
SHA256 7b978c75e59ea9a71dfecb9f7919c06a1ba79ce5aad7dbe46478e7013be152a8
SHA512 8f0d57162a8f78a202b0fd0d366e900c445fdec0969331648e62dcfc86a1b3ed9f37b51ff93e4a05970cbbd7aa6e7b67700934b5ddfd55f1754be54257548e1d

C:\Program Files\Sophos\Endpoint Defense\SEDuninstall.exe

MD5 99727c65a8f79982450dbf7fbd60a60d
SHA1 6e2c00a74a82bb6a587b08356c542aec85b885fd
SHA256 c047c1234b71a6b8e4381194a14b2b4d5475bbaed5fef632338d199232637f1f
SHA512 c680dfd67d6c4137b68b7763def15ad1ef7cee02562e3261a66368d303ffe4feec7b69a1ac72274aa425207a9fd5c1adfa388e98c94f2f5dd027b293db80368b

C:\Program Files\Sophos\Endpoint Defense\SophosInterceptXCLI.exe

MD5 8677926c60771b3bbf6a85ff14fb546f
SHA1 1308ac8e5060199bc41db58eef919b65d9d9af2b
SHA256 8447efa9e7b66cabec537a6f9592df8b8c4d38fdcd8da7dd893620d532ede427
SHA512 e0bb24b49a789277498f1466ab01f6a71a0d513b115e105d8f0de0780cf3b7d436dec92b3b4c3935c1d8b50d1d381a326d0bcf999b2d4f796d00107acbd23643

C:\Program Files\Sophos\Endpoint Defense\SophosIntelixPackager.exe

MD5 6d3c5be25e8b50eda10d8e7f1004d575
SHA1 e80e75c14ed8ab7ff55e334d1e8aced2ee8817a1
SHA256 29f970f49cc41bfc7269ac393c33830467a3ee7213689837e150cc497a81c14e
SHA512 e7d424be8172059318878c3ede9b5f8159144c980568b9f401bb42cd3a2483d3b60414faa4877227a747add131061fdff610c81bab611f1144001230603aece1

C:\Program Files\Sophos\Endpoint Defense\SophosNA.exe

MD5 965edca8688ac03543401ed524ca750e
SHA1 ab1c22ee14e3b094889700dea8f8595e7af55ae3
SHA256 dc546ccd79602e367f44a2358a484b8ff0ccbbd8626e5d178a9f910ba7e4f3e2
SHA512 90cdbfa4ddf8ac7f5888c7a75c8bc5b419958c3781cde34c2555ab9d313c46042533e53c35ec8953a13dbcd6f9b18dc1ef1cbc315d4617132a9c6bb477ea7514

C:\Program Files\Sophos\Endpoint Defense\SspEdr.exe

MD5 f22136826ceec99f7401287222e60ea6
SHA1 4df7bd2b97ee743e66cb63672860cf68e59e3ca0
SHA256 7bdf58ddb271732703edaa6a8d21e19cc78a24782f168f4f4e0fd15f78a437fb
SHA512 213fb29daba6f6d06a3bcb34e4fae1368582e41e9c16a493c719a63df64d27dd2aba35957299aedd04f3ef5e803d443be965372ed8ba4dd4aea3dc07e4c14a77

C:\Program Files\Sophos\Endpoint Defense\SSPTelemetry.exe

MD5 1aa27fa4048bb8ca276c2f0913a9f250
SHA1 2a9f6681f4522b74c1853ecfe1d1aea2a5388fbe
SHA256 745fe0a21da7b2f5494cad9fe8189a6aebc6b550b16aeee01593783c8507c905
SHA512 29abb25fb765599960fae5bd46dd2764eef88b11f713028399fb2bcc7ab0a3728996396230192edb4a347850330446b4f9c0e45c88b139a2b00463b7874faa8b

C:\Program Files\Sophos\Endpoint Defense\SSPService.exe

MD5 5e84d8d015dad51131c15c9db426a19f
SHA1 9d4814a33d7c8ccecb7e387cbf1c9760cacd4a2e
SHA256 193390a09815cff48aa24c78c34d5bafa5990f8266dd26a72730fff837e8a7e5
SHA512 91c5d26bd44d44254570c1315f4db7a24868369207644bbf64239baf1d087532d0cc5416f6a5515987a9989e9a4dbeded14f144026bd410f61afd7e6a3c46897

C:\Program Files\Sophos\Endpoint Defense\SSPDevCon.exe

MD5 e42914147a7d9ed6241dd259f69e3a92
SHA1 785bfce22b01e8a2a10bcb6e69deb66fd35448f6
SHA256 7ab58ab033cb4cdd290a20edb6465a505dd3430a354d6ed641fe1bc3dfba7d00
SHA512 7814302776f2f6efd24c8e68b09fc03bfcef59256a1f5468333d55fcd7d65caed2c289f7c5d76c7b3a1de1bb84e4db990f0dba060b32d01ed783de4638b7d36e

C:\Program Files\Sophos\Endpoint Defense\SophosScanCoordinator.exe

MD5 5b94ffb487d1e17e32450594597838e9
SHA1 7273878474c59937f5d54b07e2928c427288bd57
SHA256 21f0ac79713a9e67c6642e5deeebfe9e3f04a297c5e8e4c035195bc127ef58aa
SHA512 c5592b2563c4e23e8028311893248b5bcf34d64dbfed14662178ad82415b91b5bb161dc5ca81b8a30cbe1a158f0ccddbe9bb0bb1c1bfbaba7acae5ddbc625026

C:\Program Files\Sophos\Endpoint Defense\SophosSafestore.exe

MD5 7ba5b8fb84444bd71964e0631ab2236a
SHA1 34c77ba3e684baf470e7895df44ac85be2018291
SHA256 c97aaacf38ad1a737d660bea811db9902dc795f51dc3fd1148e4f9e8ab072df3
SHA512 f9dcfa514e69692fac05b96c3e6315823fe80bf0aad59aee128ae0a1a8f347e5f5d73e00b2baf06c84dc6e19f52baf1ef91de47227f7bc8f403432726acda76b

C:\Program Files\Sophos\Endpoint Defense\SophosFileSubmitter.exe

MD5 21b772068a5850f8151a5297f89926d8
SHA1 56d2a2b8e01ae7bf5bc6a1742f08e02fb1cf17f5
SHA256 7f28b81222b612a48d8fc644a223214d780416d810d7e4a102ae3feab5030eac
SHA512 69da0578cb536794c51227d474b9eb28f286b6364a915e69400d43465095b3dfb3e9e37fd3254faee0819d261f46f5a111241c55e45e6b10cbaf2c6629ab7d08

C:\Program Files\Sophos\Endpoint Defense\SophosEL.sys

MD5 ccf0203d5c0af4f44015e2109c27de61
SHA1 d4a5e95ffc1b0c326f3f250d1f0bc48bb5abdc6b
SHA256 c761cbe355f8df87faa88817c8c39debc0b54ccb3b807204a0e4e8aa7db14938
SHA512 29d5bc41aaa4310681ed8f7e7928d047740de5797141d97696e60e0f0b644f5c5e821da26bb2aa42fdf1d56547b473f715406d4d0a84c33588283510df53a435

C:\Program Files\Sophos\Endpoint Defense\SophosEL.inf

MD5 30da1693f9b672e0b3c63a1c164738c6
SHA1 ba491062b5ae13b5bcf756b48e1321530d1ca719
SHA256 f83eb533c2b381cb2276c4a0fe107696827ecf5ebe82b792f6cf6f160790a35c
SHA512 9ace26f0f6c6080646883a6f03225a34de4f379def220edd7f049161ddbd97521c53284ce835829e41d0d2979fac9f23e024b67536c223c26bed8bd000633de6

C:\Program Files\Sophos\Endpoint Defense\SophosEL.cat

MD5 42ad9206150ad8df26eba29cea4e792c
SHA1 4a9a379b9bf98dd711e778341a83089563ce156e
SHA256 885c156216e49cc290a54d34704fd6584b2066eca1da94bdaf49ee5fae8a8202
SHA512 88ba3960d229b3dae6c37dbc1a3dd264c029114128d7e47c2e8ca63e51a5cc04cad9a825f7d6d121dc7db9f36f062c29d45956529f3d1c6d03185acc18e89ca0

C:\Program Files\Sophos\Endpoint Defense\SophosED.sys

MD5 455cedbb4e953cfd9878c129cb7be91d
SHA1 0bf24664f58cf22383a3c8ee51da738a2612f1a2
SHA256 02b2cac7f39439115e08bed33c30098b5b5029b536047455f1d919154c352ba3
SHA512 a7ded612fe3b01a92b156db224101a0ea7f591237f532bd0ad1dbe996dbffacc901597baad97ecfecd614cd2b1fdb0561c873ce4b6ee8d06af41846ee64bcabb

C:\Program Files\Sophos\Endpoint Defense\SophosED.man

MD5 c4e99d6aae22f7746a14b71b08590891
SHA1 84a0f287bfe04f030041df9a9e8b53d43c3a7590
SHA256 add86a5d8b9348b36215a26441b247933e506fd30836aef43bb8d6cc08b1355f
SHA512 72d1a38bbf8ad1b6c2ebe4c9471caf81ee5af09296625ba4ad0097e80e76c457830178f41ebe98ccf975303a1b830afffe630e75de77fb443736abcad0a6eb4c

C:\Program Files\Sophos\Endpoint Defense\SophosED.inf

MD5 47c18d8e064c9c7ad73bc652a496d860
SHA1 4da8e615c64ab544daa2a9d94f12f320bf3a651d
SHA256 801932cdffa3f9da27015efc54841f0087426fab0bccdbcd92ca9c78a88229e0
SHA512 5d32492741c859ec2b1f551e882623731674017ee1495b63eecb01f7bac047b5c9e93d584877d758120e1042912b017ec5e536ed4e29b600747c07c73572b45c

C:\Program Files\Sophos\Endpoint Defense\SophosED.cat

MD5 82d18c5da6d70b886b785b3754437a69
SHA1 98d945fd5e6d7eb61b4e32431ad76b0d52c0ba10
SHA256 660091cd877d98f614d6c725008bb8feaf13393360582093adb9529c0dec1e6b
SHA512 2217c9f19a5a56e071ee02424e26c2cbab9e2b41df89bf28ca3265afc8bbf26e3f35ef6320800b75b628bdcce38f978ff474721cdc372943ed33ee991156b147

C:\Program Files\Sophos\Endpoint Defense\SophosCleanup.exe

MD5 862e15e84987ed24d46cd1caa691d1bb
SHA1 dd02f61bb2c7d7be3f55d5a93606252bad861bb3
SHA256 0132bb3828da804e79e9a231c023ab0775748966bf21161942ae18ed08747ef3
SHA512 2446c256c801b02fc3ab484d63086441837633fe5e3cc2f801df0954fcdc248eb0ef0833bbc712fa9bee7f884c792a77c9b57f954b986f12c6dcea30f958b01f

C:\Program Files\Sophos\Endpoint Defense\SophosArchiver.exe

MD5 06e2b809cdd076cd2639115ad5af83ee
SHA1 463f74a3a7cf69aa16daf38201cc18e4e3cab510
SHA256 6233449551676728875012d324f08bb336f70903301e7069869532e8dd17d124
SHA512 0b42e44004377803e309336cc727187dd6babeb1a8c3715bc38a9b207b9f9def53fc3dfabc783212d3d5a9f36409d6b9963ae062fc7013b34cf5aa30a28009e8

C:\Program Files\Sophos\Endpoint Defense\SEDTelemetry.exe

MD5 c8a87f3179d2418e575b7db901678421
SHA1 8df8e0dca7d6f0bab10a32996384d752bae1e966
SHA256 3918db97799034daa99aaa2a0ce06c970e7e96380a424ef5610868ff9dd3ea2b
SHA512 8eb05538b84b81ba8001d02dca4b01aba339748840f29116d291cd0c28c538334e8a6ad520e2e98d210a22c98a249e21f02ce4d11f4ee9bb6745deaf5ddbaead

C:\Program Files\Sophos\Endpoint Defense\SEDService.exe

MD5 5292ea4ebf90613a3823d4d498f9a92b
SHA1 f7469900d9181e2892691810b470cf1749cde9de
SHA256 1aff72a9056c7b4e81f15143944b2fdf6dfd46acd988ba5c9814d866abc4997f
SHA512 99f8473150020a37c750ddb1b430f5155d4938fb6958583374de6dd52d1bec4d27365d9ff8280b047be8c6715d3bad7e6318856f292e9440a2f6634ddd50d33b

C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe

MD5 200eeed800ae8056db4f97c1d68e5d9d
SHA1 a2977718189399240f1b5a8ef3f812e8e569aaae
SHA256 5170190f231fc129fb996fca1274c8801006e7913b50c313f516d3445c18352b
SHA512 feb6d509fb04d5f3cd3dd39e6718ae1b964e58558588ebecdc738044e8c404d6cf62c66cdafb6ed26d43375437945ed38a10d97bdce9156f594a7e37d8a5a413

C:\Program Files\Sophos\Endpoint Defense\SecurityProductInformation.ini

MD5 8734e382444c341867493010cf77e2f8
SHA1 f064a771eb16a8d19b2eaaf0ae13f912bb421265
SHA256 638f98ae5ef1b31de801f4b9d8bc0740ac72d77c8bf15ab6f1850b8a5ca439a1
SHA512 0a6fc395e0d5fb42b73cba928eaeedadb5301d963368c3e15489c3972aae4ac6895ae21f7d28656b6c5bc5cb348d0a192fea7d5b33edac7fe3d7b57d85de56e1

C:\ProgramData\Sophos\Endpoint Defense\Config\Rules\RCA-binary-load.dat

MD5 06ae4737547faf93e047bf89932dd436
SHA1 515f05271477681d6423c1b08c678e0d356dd372
SHA256 6dd6b515c8f6e6d030929015fa176a94916ebdbb3c34a67898f6754dccf2c3a6
SHA512 810fd31982ce581d9d8f2f4d696ea5ed09add122231fefc3a56a5307a5b42bd6e1541127192506850efe3a4b9910e2c6b00bdf54c02216f8e6df07a9a64065b4

C:\ProgramData\Sophos\Endpoint Defense\Config\DevCntrl.conf

MD5 d7e9e097aa1f9d0acd3b767aa8530cf4
SHA1 3a5968bdc8d398be4013da227fe9a4c0bab5299b
SHA256 c8eaee05192328d9eb63857405ee57078167ddc9c3c07c5358e68f76524f257e
SHA512 488e825433459d970931d280bbb3286214d40420e2aec85af699ef51e6698ed25b3a62f807c306c4c88a354c144a0f507d3b0fc48f4d77bd80f4751e2a460159

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\devicecontrol.dec

MD5 55646db1427f3db07111d012d79c186b
SHA1 8810176a8636ebb1929af310d7601bb07c880f90
SHA256 f4b30e81db280ccf0d1b23608c0edf56e4552ece458b8df0bbd758a7f56062ed
SHA512 ffb5df0a2a09f8d3887e900c0bc715de40059405ecbd6860f4aa6c87f049fcc63aa9e26eaddd3f34cdb6438dcc49f7a27079e7761a552c79077a80f1aaa2a7f2

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\dlp.dec

MD5 aa9ac0b94d8ff74fe5cd8ed6875e2706
SHA1 87f55fa23d8e7434bf2fcda2bded9c821954e906
SHA256 a5b70918fc3131c383eb1e3688cf296ab2d8af6f1a8b49b248c9338abf093b1c
SHA512 5d26111d4afa749f58ce20c58ba71898f3154818aadd79d228afe6add761116c8592e28a2869d68619642d328d2f7ba4b4dd1352cb8879e6406709365c003a17

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\hmpa.dec

MD5 ba4c42e06ae6f9bb54ce57713875c04d
SHA1 f96ead2d3f7cb089031875f7a400d5caa12fb869
SHA256 0d9589720fe3c7de4dac85f49cb3268bee70bc14266ebbbb02f9972a3b8b8d4b
SHA512 094dc99f4943e76eac5e7a4ccf03a7a27c58188c421c6dcb7cb4978f5aed6cf69ed9f644dcba6077a7aabd11e0839b7c4feb3d9067099cfed68f329438f60e2d

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\web.dec

MD5 74b8f814854600246fbbf2d774ac45a8
SHA1 ee3cf67362a09d9ca041303d5175d9b406e88a76
SHA256 bde8e86287543fe932283f9cb6c6da52d772e4dfcd73d05edd4075afea904562
SHA512 f9544d159d7c6db2047d880b9e90e73cd77dc1f8a113803bf1327f3288f40e07053d9ef082cb43213707806cf5229a3ac93ee3f65a473a2214735dae8787d1b2

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\static.dec

MD5 1fc23736ef87f42018acaa38458e7fc6
SHA1 3bcf3d696a752047c76dfdfa50a1946e9e6b4db8
SHA256 b7ff605c84fc1d54fdc2440ea310c956dd8bf78b0120c321299c24f7d3a651c1
SHA512 ec03e6c7b3750c13c8690691f5f21e6ae23b48ce9f54ed985efd29c9c5de3428f0cf6701c92343f3bae54c96a087c39f80afe9100b12df58d97cff73af1f2e10

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\ips.dec

MD5 37ef4aadbc4abcefdbb3f52a40fe9bdc
SHA1 480c843f4cc9a7d7a065241ce90978afee896429
SHA256 fb823b18b9e3ecb4348707112c2f594909447be5067b3eebee57c9ca96c527c4
SHA512 244cfcb23bac26e367ff70bc145741c9ad3af015a9db127fa4a08faaeafc778f64829a8320c8d493d576cd2856d5032f4bfb13f5cfcb2dca36b83b01d6c90c21

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\amsi_uac.dec

MD5 a66e13960089f59c47de9ed14ad57130
SHA1 8d6f35681946a26c4001ebc2f9e294cc056340ec
SHA256 ee8213582495512fadd67c83d0db92ab481cf237078a6838ab3fd6753f01e228
SHA512 e1d61a1aed3df0b6c29485e3cff43133cec473244521ff161cf8ff371d5675567cd3ea0302e95329d7ac70d166440b556b66a11e4ef3741c565c09ce32b14df6

C:\ProgramData\Sophos\Endpoint Defense\Config\ProductRules\amsi.dec

MD5 8641bb3121344c3f784b08895264f360
SHA1 ddc554843752850e7f6076a5edaca6eee77aeae9
SHA256 238770d966dfa90ead296a019e2a4582da5fe43b4364012eb88be4537442eb1f
SHA512 94e031555f9b40be399121a9286717545372d40285075068c83d933a6374e44423a42e09c30ff57494fac73c7b025bd4503c159551c0a2eb24c27e02b2c8b049

C:\ProgramData\Sophos\Endpoint Defense\Config\MainRules\main.dec

MD5 85f96b64fd94a2482c359d2995509a6c
SHA1 8b38eabd6fdf87f0edfa0caea35348b91bb881a6
SHA256 6f30d1778b6fd7669dc171bea51cddbb9aa0ffc56dfc8a94a71efe39c865f780
SHA512 1f402b07e193118baf6e97e9db1621ef065712e9e9049d41dbe7d7b5c4d01ff0233af601019bfe98841c08e1689d9f7dd857737a3921c53250cf36d61a6b934f

C:\ProgramData\Sophos\Endpoint Defense\Config\Rules\rules.bin

MD5 6f3da0a3983d2f081d29f280ee376c96
SHA1 d9832d2335d91d4f6b7ae1fce7faf6ed999fb56c
SHA256 a079d65b8bb5527a0276febc3a7cf3266fc7d45ec4eed0594afe10ac11ee4857
SHA512 3d00c2021c94a353b32a54bf633c7a3a0b13e3781647cddc845bba9cf31e2554cb1a4709c2b787b792e8a7cb94d8403b6ba732daf98c4436d387281151490c68

C:\ProgramData\Sophos\Endpoint Defense\Config\SXA.conf

MD5 b6a61156ebee4574858009a6d5ca8e94
SHA1 3b84b436aca24a701198649f46b8948f2073ab0c
SHA256 d3e76e98a97fa64f53b7b4d1bc5b5f5cc232442a04babf1d482c0bc57f6ee535
SHA512 0427481d48aaac8ec2a2f635b850da771818c30760dcad72426ef0cdd4585d1789bc23064c0469117661d400c46f704f5f4d26e242dfb962212f0536e3cb4423

C:\Program Files\Sophos\Endpoint Defense\integrity_sel.dat

MD5 2bbc09324976d48d79984e439cfaafe4
SHA1 ddda4783f84e9d47793a35a604a0e87a00a6471d
SHA256 1dcad8cb4e38eaaaeafeed364c45b19a7f0f27ec1abbe21f6c87ec592aa0fc86
SHA512 bc4ffd2e38588fe26053cc52f8e805341983c9e1d236b7eadc88025fd3f5326c1f4aedef9b2565150cdfdc81a9581d806752019d4b85200b0c058c896c12f5d6

C:\Program Files\Sophos\Endpoint Defense\integrity.dat

MD5 f19d0623c791be4f9fa655966cdf8989
SHA1 88ab25b75ae5541e759579d25fa932f5ca47e12a
SHA256 f6d8023659f86f5e7b48cf5b1162cbdd637156cb3f3b302c872bea9748df8b11
SHA512 5b966fd9a0163002839fed60b5889b2f1628fb5036f6ab2a3c6f82494496cd9ffc13775841f9d157de87944caef74fd99f4fc19d744be755e5405836e8217ae8