f0c3c67d1099fb21019694585646996f465eae28006dc248c0adfeac1e8fe189

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2023 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24a4039692a2d0baa28bf7ee0456f82c.exe
Size

1.0MB
MD5

24a4039692a2d0baa28bf7ee0456f82c
SHA1

8b43fc96bc9bf12ab8fcf4cac1e7c1f20be4a6f2
SHA256

f0c3c67d1099fb21019694585646996f465eae28006dc248c0adfeac1e8fe189
SHA512

bb8a89aaac6cebaf5a2a9bde42436794eb6bc912da7d9007c73c1783c917ff0b37c217e0d2c66b4043f923c4e10b21a4c39abbe495d45faab5990c058778a023
SSDEEP

24576:WBpJi6LbUjebhV8kk/DWgHX5BD6PhyONxWqnCsEyA:S7vYiP6S0D6PhywxbXEl

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ZoneAlarmUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZoneAlarmUpdate.exe\DisableExceptionChainValidation = "0"	ZoneAlarmUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ZoneAlarmUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	ZoneAlarmUpdate.exe

Executes dropped EXE 12 IoCs

Processes:

ZoneAlarmUpdate.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exeZANG_Install.exedltel.exeeula.exe

pid	process
4416	ZoneAlarmUpdate.exe
4816	ZoneAlarmUpdate.exe
4448	ZoneAlarmUpdate.exe
3032	ZoneAlarmUpdateComRegisterShell64.exe
3536	ZoneAlarmUpdateComRegisterShell64.exe
4716	ZoneAlarmUpdateComRegisterShell64.exe
3148	ZoneAlarmUpdate.exe
1708	ZoneAlarmUpdate.exe
3092	ZoneAlarmUpdate.exe
4752	ZANG_Install.exe
3680	dltel.exe
2320	eula.exe

Loads dropped DLL 21 IoCs

Processes:

pid	process
4416	ZoneAlarmUpdate.exe
4816	ZoneAlarmUpdate.exe
4448	ZoneAlarmUpdate.exe
3032	ZoneAlarmUpdateComRegisterShell64.exe
4448	ZoneAlarmUpdate.exe
3536	ZoneAlarmUpdateComRegisterShell64.exe
4448	ZoneAlarmUpdate.exe
4716	ZoneAlarmUpdateComRegisterShell64.exe
4448	ZoneAlarmUpdate.exe
4416	ZoneAlarmUpdate.exe
3148	ZoneAlarmUpdate.exe
1708	ZoneAlarmUpdate.exe
3092	ZoneAlarmUpdate.exe
3092	ZoneAlarmUpdate.exe
1708	ZoneAlarmUpdate.exe
4752	ZANG_Install.exe
4752	ZANG_Install.exe
4752	ZANG_Install.exe
4752	ZANG_Install.exe
2320	eula.exe
2320	eula.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

ZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine_64.dll"	ZoneAlarmUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D6CD051-BC09-46FF-84C9-9CE3E459F6AD}\InprocServer32	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe

Drops file in Program Files directory 64 IoCs

Processes:

ZoneAlarmUpdate.exe24a4039692a2d0baa28bf7ee0456f82c.exeZoneAlarmUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_sl.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\psmachine.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_zh-CN.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_ml.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_es.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_sk.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sk.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateSetup.exe	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_pt-BR.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_am.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_no.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sw.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateSetup.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateOnDemand.exe	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\psuser_64.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ro.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateHelper.msi	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_it.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_en-GB.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_bg.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_pt-PT.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateWebPlugin.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdate.exe	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdate.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\psuser.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_es-419.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_hr.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ur.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_el.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateHelper.msi	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_ur.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_nl.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_th.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_vi.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_en.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_lt.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_es.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\psmachine.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateOnDemand.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_cs.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_te.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_ms.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\Install\{EBDE5CB5-36AC-4A1C-BD92-3ACF327BDFD0}\ZANG_Install.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ar.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ko.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ta.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_fi.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sl.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_uk.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File opened for modification	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateSetup.exe	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateCore.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateBroker.exe	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ru.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_el.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_iw.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_tr.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateBroker.exe	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_am.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\goopdateres_id.dll	ZoneAlarmUpdate.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_bg.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ms.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_vi.dll	24a4039692a2d0baa28bf7ee0456f82c.exe
File created	C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_th.dll	24a4039692a2d0baa28bf7ee0456f82c.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4756 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4756	sc.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

ZoneAlarmUpdate.exeZoneAlarmUpdate.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F14E3171-3473-43E0-A7A6-0EBB438C005A}\Policy = "3"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A55D03B-5313-409B-A2DB-3677800A7AD8}\AppPath = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D5B80838-9D7E-4A94-8115-17A76F676AD3}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D5B80838-9D7E-4A94-8115-17A76F676AD3}\CLSID = "{D5B80838-9D7E-4A94-8115-17A76F676AD3}"	ZoneAlarmUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D5B80838-9D7E-4A94-8115-17A76F676AD3}\Policy = "3"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A55D03B-5313-409B-A2DB-3677800A7AD8}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A55D03B-5313-409B-A2DB-3677800A7AD8}\AppName = "ZoneAlarmUpdateBroker.exe"	ZoneAlarmUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A55D03B-5313-409B-A2DB-3677800A7AD8}\Policy = "3"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F14E3171-3473-43E0-A7A6-0EBB438C005A}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F14E3171-3473-43E0-A7A6-0EBB438C005A}\AppName = "ZoneAlarmUpdateWebPlugin.exe"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F14E3171-3473-43E0-A7A6-0EBB438C005A}\AppPath = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0"	ZoneAlarmUpdate.exe

Modifies registry class 64 IoCs

Processes:

ZoneAlarmUpdate.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdateComRegisterShell64.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3133AA91-F4A8-4C99-85FA-6C8BFE86CE62}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7A50D4F-9FCE-48D7-B93F-A45944226ECF}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62D4E3B9-85B5-4402-B456-516E9B4AC7A9}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D088BAD8-E92C-4500-BDBC-5CF5E239F40E}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE1B13CA-C8E2-46D6-B5A0-02FAD7485323}\NumMethods\ = "24"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1FADDBD4-5D41-4C31-89AE-37A6C1B63DCC}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D088BAD8-E92C-4500-BDBC-5CF5E239F40E}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD29A878-82EC-4F08-97D7-8C7C691892F0}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92785311-171B-4358-A89D-11AC094F5717}\NumMethods\ = "41"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A86AF1BE-D06B-4569-B99A-814124EA8B20}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.CredentialDialogMachine\CLSID\ = "{07567CD2-4EE7-4040-9226-D4B83474EC0F}"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24699BB-64FB-4AF5-A6BA-411D45392F7C}\NumMethods	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5C6BA10-52D1-4AB1-8A40-FF24B9705E0E}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.OnDemandCOMClassMachine	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F6129020-E3CC-4B89-B9B6-0945B68F3A8C}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{601B182F-F89A-4B53-B847-7987B45D5290}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7A50D4F-9FCE-48D7-B93F-A45944226ECF}\NumMethods	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD29A878-82EC-4F08-97D7-8C7C691892F0}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A93F6E13-DB63-493B-9170-BD91278A1E57}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A575A3D-7CEA-422B-9F46-5BBA3BD3FFFF}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC5AB8D5-6AFA-43B7-BDAE-06FEC4ECBE04}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3065C225-61D8-4BD8-8341-BB49BB3A5257}\ = "IProcessLauncher2"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1557BFC-F8CE-4EA3-9130-9F461F91379C}\ProxyStubClsid32	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CD5C033-8E26-4B96-A6FB-393DCCF30294}\NumMethods\ = "4"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF42CD96-EED4-43DA-AB7B-B91BE0F7FEF4}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E203DBE4-F5C3-40F0-8742-BDAF5E3C1E5A}\VersionIndependentProgID\ = "CheckPointUpdate.CoreMachineClass"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.CoreClass\CurVer\ = "CheckPointUpdate.CoreClass.1"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3065C225-61D8-4BD8-8341-BB49BB3A5257}\NumMethods	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC307423-DEA5-4E91-A312-A738BE74A13F}\VersionIndependentProgID	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{332EDDAF-849B-4BF4-AB55-91A7D145A5D9}"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC5AB8D5-6AFA-43B7-BDAE-06FEC4ECBE04}\NumMethods	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92785311-171B-4358-A89D-11AC094F5717}\NumMethods\ = "41"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7953CDFA-B704-435C-A81A-BF89B3055697}\VersionIndependentProgID	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{601B182F-F89A-4B53-B847-7987B45D5290}	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7A50D4F-9FCE-48D7-B93F-A45944226ECF}\NumMethods\ = "4"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40AE72F1-9B37-47C1-B09D-513425C48CBE}\InprocHandler32\ThreadingModel = "Both"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39D75D4A-0F18-484D-88B4-25153FE1DD7F}\ = "IAppCommandWeb"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.OnDemandCOMClassMachine\CLSID\ = "{DFD71C6F-13FF-4E4F-BAAF-097A1E12B523}"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF42CD96-EED4-43DA-AB7B-B91BE0F7FEF4}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5B80838-9D7E-4A94-8115-17A76F676AD3}\ProgID\ = "CheckPoint.OneClickProcessLauncherMachine.1.0"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A575A3D-7CEA-422B-9F46-5BBA3BD3FFFF}\ = "ICoCreateAsyncStatus"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8C715AA-73C2-4603-BB9A-7B67492B2D6A}\ = "IAppBundle"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E203DBE4-F5C3-40F0-8742-BDAF5E3C1E5A}\ProgID	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F14E3171-3473-43E0-A7A6-0EBB438C005A}	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{499D1391-3A6B-4F0F-844D-1DD9CA45ED03}\ = "IZoneAlarmUpdate3"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8C715AA-73C2-4603-BB9A-7B67492B2D6A}\NumMethods\ = "41"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD5C033-8E26-4B96-A6FB-393DCCF30294}\NumMethods	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD29A878-82EC-4F08-97D7-8C7C691892F0}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\psmachine.dll"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92785311-171B-4358-A89D-11AC094F5717}	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E203DBE4-F5C3-40F0-8742-BDAF5E3C1E5A}\Elevation\IconReference = "@C:\\Program Files (x86)\\CheckPoint\\Update\\1.3.99.0\\goopdate.dll,-1004"	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.CoreClass\ = "Google Update Core Class"	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBA995AE-E466-4EF5-B49C-16C2BF29305F}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}\InProcServer32	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CheckPointUpdate.Update3WebMachine.1.0\CLSID	ZoneAlarmUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5B80838-9D7E-4A94-8115-17A76F676AD3}\VersionIndependentProgID	ZoneAlarmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{499D1391-3A6B-4F0F-844D-1DD9CA45ED03}\ = "IZoneAlarmUpdate3"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF42CD96-EED4-43DA-AB7B-B91BE0F7FEF4}\NumMethods\ = "4"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3065C225-61D8-4BD8-8341-BB49BB3A5257}\NumMethods\ = "7"	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5C6BA10-52D1-4AB1-8A40-FF24B9705E0E}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3065C225-61D8-4BD8-8341-BB49BB3A5257}\NumMethods	ZoneAlarmUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92785311-171B-4358-A89D-11AC094F5717}\ProxyStubClsid32\ = "{1190AEEE-4FC7-43DB-BBFF-6D5840967C56}"	ZoneAlarmUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBA995AE-E466-4EF5-B49C-16C2BF29305F}\ProxyStubClsid32	ZoneAlarmUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ZoneAlarmUpdate.exe

pid process

4416 ZoneAlarmUpdate.exe
4416 ZoneAlarmUpdate.exe
4416 ZoneAlarmUpdate.exe
4416 ZoneAlarmUpdate.exe
4416 ZoneAlarmUpdate.exe
4416 ZoneAlarmUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ZoneAlarmUpdate.exe

description	pid	process
Token: SeDebugPrivilege	4416	ZoneAlarmUpdate.exe
Token: SeDebugPrivilege	4416	ZoneAlarmUpdate.exe
Token: SeDebugPrivilege	4416	ZoneAlarmUpdate.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

24a4039692a2d0baa28bf7ee0456f82c.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exeZoneAlarmUpdate.exeZANG_Install.exe

description	pid	process	target process
PID 1872 wrote to memory of 4416	1872	24a4039692a2d0baa28bf7ee0456f82c.exe	ZoneAlarmUpdate.exe
PID 1872 wrote to memory of 4416	1872	24a4039692a2d0baa28bf7ee0456f82c.exe	ZoneAlarmUpdate.exe
PID 1872 wrote to memory of 4416	1872	24a4039692a2d0baa28bf7ee0456f82c.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4816	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4816	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4816	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4448	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4448	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 4448	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4448 wrote to memory of 3032	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4448 wrote to memory of 3032	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4448 wrote to memory of 3536	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4448 wrote to memory of 3536	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4448 wrote to memory of 4716	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4448 wrote to memory of 4716	4448	ZoneAlarmUpdate.exe	ZoneAlarmUpdateComRegisterShell64.exe
PID 4416 wrote to memory of 3148	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 3148	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 3148	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 1708	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 1708	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 4416 wrote to memory of 1708	4416	ZoneAlarmUpdate.exe	ZoneAlarmUpdate.exe
PID 3092 wrote to memory of 4752	3092	ZoneAlarmUpdate.exe	ZANG_Install.exe
PID 3092 wrote to memory of 4752	3092	ZoneAlarmUpdate.exe	ZANG_Install.exe
PID 3092 wrote to memory of 4752	3092	ZoneAlarmUpdate.exe	ZANG_Install.exe
PID 4752 wrote to memory of 3680	4752	ZANG_Install.exe	dltel.exe
PID 4752 wrote to memory of 3680	4752	ZANG_Install.exe	dltel.exe
PID 4752 wrote to memory of 4756	4752	ZANG_Install.exe	sc.exe
PID 4752 wrote to memory of 4756	4752	ZANG_Install.exe	sc.exe
PID 4752 wrote to memory of 4756	4752	ZANG_Install.exe	sc.exe
PID 4752 wrote to memory of 2320	4752	ZANG_Install.exe	eula.exe
PID 4752 wrote to memory of 2320	4752	ZANG_Install.exe	eula.exe
PID 4752 wrote to memory of 2320	4752	ZANG_Install.exe	eula.exe

C:\Users\Admin\AppData\Local\Temp\24a4039692a2d0baa28bf7ee0456f82c.exe
"C:\Users\Admin\AppData\Local\Temp\24a4039692a2d0baa28bf7ee0456f82c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdate.exe" /installsource taggedmi /install "bundlename=Product&appguid={814E4157-8A6C-461B-A80F-B75931228CA1}&appname=ZoneAlarmNG&needsadmin=True&lang=en&ap=ZANG_EA200&usagestats=1"
2⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416

C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4448

C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
"C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3032

C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
"C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3536

C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
"C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4716

C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4816

C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTkuMCIgc2hlbGxfdmVyc2lvbj0iMS4zLjk5LjAiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkI2Mzk5QUItRkRBRi00NkEwLTgzMEMtODVEM0REMDgxQzdBfSIgdXNlcmlkPSJ7MjFGNjM3NDItQUM3Ny00RUExLUI0MjMtNTUzMkZBQ0VBQjVCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezBFODlFMjA5LTA3MjctNDYyOS1BMjQ4LTFFMTJGMkExMTJENn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy45OS4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTM4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3148

C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /handoff "bundlename=Product&appguid={814E4157-8A6C-461B-A80F-B75931228CA1}&appname=ZoneAlarmNG&needsadmin=True&lang=en&ap=ZANG_EA200&usagestats=1" /installsource taggedmi /sessionid "{6B6399AB-FDAF-46A0-830C-85D3DD081C7A}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708

C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
"C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3092

C:\Program Files (x86)\CheckPoint\Update\Install\{EBDE5CB5-36AC-4A1C-BD92-3ACF327BDFD0}\ZANG_Install.exe
"C:\Program Files (x86)\CheckPoint\Update\Install\{EBDE5CB5-36AC-4A1C-BD92-3ACF327BDFD0}\ZANG_Install.exe" /SKU=AM,AR,FW,WebSecure /Product=ZA_EXTREME
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4752

C:\Users\Admin\AppData\Local\Temp\nsf14A2.tmp\dltel.exe
"C:\Users\Admin\AppData\Local\Temp\nsf14A2.tmp\dltel.exe" client_version=3.3.407.0 unique_client=NoClientID type=211127 meta_data2="{OS_INFO}" int_field2=-1 int_field3=0 int_field5=0 int_field6=262 int_field8=-1 int_field9=0 str_field1=StopCPOSFW str_field3=3.3.407.0 str_field4="NoSKU" str_field5=NoClientVersion str_field6="NoInstallDate" str_field7="n/a" str_field8="NoLanguage" str_field9="NoUMID" str_field10=NoClientID
3⤵
- Executes dropped EXE
PID:3680

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" query cposfw
3⤵
- Launches sc.exe
PID:4756

C:\Users\Admin\AppData\Local\Temp\nsf14A2.tmp\eula.exe
"C:\Users\Admin\AppData\Local\Temp\nsf14A2.tmp\eula.exe" 10
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CheckPoint\Update\Install\{EBDE5CB5-36AC-4A1C-BD92-3ACF327BDFD0}\ZANG_Install.exe
Filesize
253.9MB

MD5
85ba23187f962ff38b346ef60e1b0a59

SHA1
a6e9f5b3b922110547460df18e438560ca46ce2b

SHA256
80ad83b2d1cbc70045502884a8acdf7edccf4e22ac97b0e0980c00db2101d073

SHA512
9b2d4dc011ef09949c338b868803e1dc4e7e7b53930abfbec734ac9c907159ada267731e9af74a91912896bc2f74dd90fe9ad54330fe05e345c09c32d245e62e

Download Submit
C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
Filesize
162KB

MD5
e48a5f1635cad3870bcd52980d7d9ff0

SHA1
070421cce834bea5ef13cd309c6cf22619c1b2b6

SHA256
980b2466f65aad81ee76cfd5e3d2c434752fe5d2118b35919f112948486cafd3

SHA512
1683376addb7229c5aff29983f180776b6e9d892fd55aeda7457dc8cb981144a2c9a7a9b27883a0a05a8c7a32b894996f3076f0aa57b7b798d4c787ada7fd99e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmCrashHandler.exe
Filesize
279KB

MD5
041237abbe8c282b1cd4c30891890959

SHA1
ffbf1504f14b030956f57b9a5b1d8edd6d19e338

SHA256
e8faf199a12eccb4e9feecd96252d5a09e87d90a18c37d3ed3ac7888783a9978

SHA512
61425b427a77c2ae2e566c5602908fd48d88d6079e3ee82c0890aa7d5c745ab984c6a79e1160ac34751f06233f056ec36d756d7876e64ee1272e60cd1cb77296

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmCrashHandler64.exe
Filesize
355KB

MD5
57c02d41bdf6a8f8d5a62b5f6ce6c8e8

SHA1
4f45aabae9c2b6692285402bce1860e6f32de332

SHA256
3f5960fe7b0a67543475747d76dd91d0c583428c28a8fb712aecf06a69b2888c

SHA512
8a2c57d89160496b556e6076855f5cea79bbba9c7514560f830c35eb735327facf79f68675b7e58576c5ac2db1be1a334a1c692874fa9f29d27c66a7c2d90c4c

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdate.exe
Filesize
162KB

MD5
e48a5f1635cad3870bcd52980d7d9ff0

SHA1
070421cce834bea5ef13cd309c6cf22619c1b2b6

SHA256
980b2466f65aad81ee76cfd5e3d2c434752fe5d2118b35919f112948486cafd3

SHA512
1683376addb7229c5aff29983f180776b6e9d892fd55aeda7457dc8cb981144a2c9a7a9b27883a0a05a8c7a32b894996f3076f0aa57b7b798d4c787ada7fd99e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdate.exe
Filesize
162KB

MD5
e48a5f1635cad3870bcd52980d7d9ff0

SHA1
070421cce834bea5ef13cd309c6cf22619c1b2b6

SHA256
980b2466f65aad81ee76cfd5e3d2c434752fe5d2118b35919f112948486cafd3

SHA512
1683376addb7229c5aff29983f180776b6e9d892fd55aeda7457dc8cb981144a2c9a7a9b27883a0a05a8c7a32b894996f3076f0aa57b7b798d4c787ada7fd99e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateComRegisterShell64.exe
Filesize
167KB

MD5
5199e0eb77f80e2387fc6bc0f2b3d551

SHA1
b2b4d8556a74fcd4f5c64ea4d62ce837ba342844

SHA256
eeae53ef1fffa0ecf7986de8943a8c0b52f56bdeaf679650f84deace7c33a483

SHA512
66927a1bc50337cd079d8c1665472f2717518a2cc876ac70cec7fbfd90b36a8797f9149b5a08a4f8ea11222a3cf1b3f126f26a01904f14854fbc744df0c14916

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateCore.exe
Filesize
585KB

MD5
ff66c67af8b2f663be474f978bfdb1a0

SHA1
a9d206e2872907aaaad0bfbce83a3900910ae850

SHA256
4a1cad04ed0628fb6171675652af4861081ff22e99e8531255e9efdb2975ad3b

SHA512
9aa647fff03796239d6366d38793b0bf11b09e9f892e0b7e7a005cf108686181275f5e42e9887a596fa1f6cd6b17c836f8012e7988086042175b91fe796ddcc8

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\ZoneAlarmUpdateHelper.msi
Filesize
40KB

MD5
6def496aa8d6e1d3a5569f55348bc686

SHA1
782069f08e47bbf4359d47e07d6b65115757b12d

SHA256
86bbe72aec9564a6738254f7bb1bd404a7b1ff5c02f4eb1490a9204c513909a0

SHA512
33aec117fad18ee14630735e0ed7e466dc376e458b04423ccc5f1dc1a3756cd00b42c1de060899a3f3caeeac490c3a7e9a0a3a830aa1888f2b6c87df9a935cfa

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdate.dll
Filesize
1.7MB

MD5
474db0ab6ca68165f911470457ebeaa8

SHA1
8ee5a40fc209bc9e042d80b2e39fb71b3f5cd8f6

SHA256
e9c1679f31a088b3d6519caeb3d54d3bd92f3a0365357b31b0c0ae96914e8fdd

SHA512
b3d489b7a4b3a3493837024f0972774d2f90021b3036df2056b110a180e21d535b08b080cb3499f4d17f5d0e79bde694e74a65384a0cc3724a53172020597371

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdate.dll
Filesize
1.7MB

MD5
474db0ab6ca68165f911470457ebeaa8

SHA1
8ee5a40fc209bc9e042d80b2e39fb71b3f5cd8f6

SHA256
e9c1679f31a088b3d6519caeb3d54d3bd92f3a0365357b31b0c0ae96914e8fdd

SHA512
b3d489b7a4b3a3493837024f0972774d2f90021b3036df2056b110a180e21d535b08b080cb3499f4d17f5d0e79bde694e74a65384a0cc3724a53172020597371

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_am.dll
Filesize
38KB

MD5
3e7ba40521b22d5b996fd9fa7372f779

SHA1
844e4e9051ae0949a2ad22aae610fb170eb5bfc5

SHA256
978b88afaf052c4fab7eb12e366ca29df83c386c8a42315b2acaeb95ec722325

SHA512
cfd1fe3decd71e60e151816af68de5a5b302afe9ce517af81b10983fa27936835256dd1668d14f15031596dd509dacaec87d1d85240d0eb664179697341ae24d

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ar.dll
Filesize
38KB

MD5
895897bdbe0939c0d4f51bc68db96dfd

SHA1
b82174af4d3e1e6a669bd18676fd72c6e5bf6256

SHA256
e3455bec8453b490bacb5e35934aa536cc47a4512a1633ab7c2cc363fa309a71

SHA512
cc90c241abf98ec82a7c51694d53d6cc8d5f178babf7afbf141a77d001ba5d5bb0de820dceb97856522b851d3abd804ba8dbf1623023df4eb984742f0ebe48ff

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_bg.dll
Filesize
40KB

MD5
ad1bfa8ce2d5d4501a25d23b64c22798

SHA1
d882c9a6cfff091318cc382df7892d7048ddf37e

SHA256
4135fd194cbc52a4e7bf7300911bc00311a2ebac04958a84f6caeaa9a104a58b

SHA512
efd74f6452cebe16f6f9e9f0100f88e1a3262e8d5af6023d35c8317a57f91a53af4269093ea467b048643826f8356e10990a7342ead8039bbbd064a7546daa3e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_bn.dll
Filesize
41KB

MD5
c079d6085b6dcf4276f66588468e2823

SHA1
bc3aef31e817e4a0d08e8b4a1d4fa7f26fdf9a31

SHA256
7b654e29076fa77b2b2e8c477b3fe844043fcaf8ab34f21329af7033b22dd40c

SHA512
5a34f9f85749306b9d75ea1c6893d5ccc3dd52eaabfbf934e48a7a80caefc4aa2d3eb0c9d14c6c9b59cc43cbf80562c4fb278441312c71eab6aa285cbbe9324a

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ca.dll
Filesize
40KB

MD5
f305384449356a56f9141b91805dcc38

SHA1
90a80224d248163e9e796f96feea75d476147d41

SHA256
2443d8b998bff1c795f8c51c96ee61c7a6aebbe2821e316c88aee726fbed9213

SHA512
7e85bffa0682df848f2364e94f4a0063254bcc21fb0583308a794dc70bd6f02967b5520c9b852c4850a2c5e77b3bb10dee813814826c2223a0e2614644f30fe5

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_cs.dll
Filesize
47KB

MD5
5fe00b272434117a7963fbce1b96967d

SHA1
db2ee86e79de84a50714b4dd7f7e20cf210d0844

SHA256
87f711ac3a115cff8a3b425d5ee2bf8af5eff4b0bb0e8dfba123f68ef1e18b96

SHA512
2763451d954e998e691db2355d970a8b714684a6ba6a4d2e9b09360ca25e0eac5b03723374144e26a62b5d5833d41fe6d61b98cbdc9c428c224b4237aeecc3c1

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_da.dll
Filesize
40KB

MD5
11cef50f49cf5066cf1c8e8cc3d0bb94

SHA1
b144cdc065c667daa61cc5d9d84b66820735545a

SHA256
ae7f8be5777b3c9c8f99270c86c30a02e784201de4f0ed61f8fcb65eee61ff78

SHA512
79e4c103933dbbb0c18d15c896d6c7faa52cc2366ba3e67261835799b0ea0a75263d6d2646d1f7fe74abdd2fcc8d0c1fbeaadf3b49e892905c3e7c41a91dea7c

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_de.dll
Filesize
41KB

MD5
e34e6ac03ca62f50657d3a32009d85fd

SHA1
a8481884ec468f7c4c2af9baa73fe8b4bcd81fd6

SHA256
5e129531c9821db475f88b92efec2a3aa1e083d27cfaf2b53ecc3fd4eb611474

SHA512
69a7d635f45c30ac85a0aad1647c7febe6713c22a866b420ccbb8254b5924dc3334995ccae92f18438d9643840556c460c1afd3304eae6bb2928d94bd936a88e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_el.dll
Filesize
41KB

MD5
97d03b2efae17fd100ad34b1466cfac6

SHA1
d64b8981fcd0e8e25dc430353694f19a0d1efebc

SHA256
59b15ea3b15f67cb599c0e1ba09cae3b6efc30ace7711f3b52212e2000bb9c2b

SHA512
b3b8a2bcbf65674b35de4b080cde871ee720cd808d1ff7763de6d22b771968c0870109e0f37d990428a5f6199a5e44f00a847fb2989d8a10381dee9926b6a525

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_en-GB.dll
Filesize
46KB

MD5
2085ba390dc6582b8232853bd415ab45

SHA1
73d6f4a8df3d839f548f2f143188ea2492c5afc8

SHA256
5bf10b7d2f24f2c620fa7423cc4542623bad06843ea80dee6ebeed5390e71af5

SHA512
ca27053f08c4b00bfb476369b2d729a3db8fea3b82a0f2125d9bf0e4e53644eaecfa00bf756d250be239b738b97d96bf6821abe5ac3beb41c0c03d382d0a24be

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_en.dll
Filesize
46KB

MD5
1b94643c5700015c1a5c0ab1f41c84bb

SHA1
ab55c7689c3350a0ddbf582ab6d5c179f02c94f8

SHA256
10ee192914ffd099b2bd4fe72d9e10e49e664a401df809e3274bb7d117522a86

SHA512
a9cdf2bc82d67736fd61ce03e268b959fdf3791442f521a927a51cfe8b6f7251fdf64154069bcf9cf451e5a1a9e8fcf7035cc00175c952fd958bc807647b7a56

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_es-419.dll
Filesize
40KB

MD5
6ef6a8f2793691def47af52f791cb8ad

SHA1
f7aab73965ef1a0f504673c8b7e949f388fa6302

SHA256
9d1c480bf299c87135ae8ae288feeded0cb40f2fe092a7956eaaac8a4e72a4f3

SHA512
7d12ee92ca6284a1a6d47b285426f51074fd1dd42a53809474cce49ffe37b23baa7af3b8417f67b83c76de0fe80eb4017273463b732e41b6e3817072a07a8cf1

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_es.dll
Filesize
41KB

MD5
39ea8f437df6a9829b0e24e1bd707c6a

SHA1
9a6696edd2cc8609a0d5dc4446152c15631e2fa4

SHA256
76207f82d37fb0d450e5b7c8c6e17dac969ab23f857018427978947cdf2b53f1

SHA512
a0663782af9a085233e6edb2732f15774c42c22368fb3f7be1b897d0080363309c704a89b5854d8c317cc21a020daab80f99ecb2ea7102059edbef866c16cb9d

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_et.dll
Filesize
39KB

MD5
6e7fcde39499a6958a4fc775366f95e7

SHA1
9f07f5f1e969d24946647f9944d680df400aa600

SHA256
881fd00fb1700d8d4dcf2b5d37a37206d4c2b98d163522e4c5c5ca94cce33ca9

SHA512
658c88b9f68b2fc3f357069aa46657286a0e4853841afa7af69c460643799893614f82c5378a825f19b15465cd6d70d2bccc80825ec0199f3c851e23200faed0

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_fa.dll
Filesize
38KB

MD5
7d8ea5e2c517a4c27eb02b84632cde9c

SHA1
12a985f03daffcae8ee82a500f2e7b459c523f6f

SHA256
81364287ee5b31c81a70d5a2cad1c6b0ff54e6b91d724ced9c20c52e15518414

SHA512
d312796b7949534643e68883bffb9951b90468b636e204190415602726493dcf0ad2476f97408c57823cfe5c788b8011fba3b79fe58d69358c408ff34d52cd42

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_fi.dll
Filesize
39KB

MD5
ffc1551b69ab1cd3417ff80a8723329b

SHA1
cfff92cfd0a4f946c928282472408958da7e96b4

SHA256
d7539319114ab7cbb5c4c611d8783b0510a78aec390d3c7e78533926102b2ddc

SHA512
9b478e16ca1a724f56d4bc54752f40a7f39500ecac05f8ef1b0ed09e751b84a3594ab7ba8c2315e8b6a938a3248f95b57a79e58fe0e740609985441ce90614a6

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_fil.dll
Filesize
40KB

MD5
bea79932ad302206707cd7189e4b98f3

SHA1
4e9a97e5708c99e19278d1f6c5bdb4279333fa91

SHA256
5ff5caba17d1c3fb5d8a3b76055175d2b5c8a86657ce9f49e75f1ed4921b6539

SHA512
7b3d5ca948e63ae14cf450d5697c8180b9eaf3c07d11394d3bf0f8e2faa41ae6aba007e9fcae900c0ded7c90cfe987955f219b4c8ed2dbd5c7e36cc80c1617b8

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_fr.dll
Filesize
41KB

MD5
11290882ccbc24ced26a375e68204e58

SHA1
ca8a9b5c025d20d03fe7839e6559b8077e42f040

SHA256
69fd15f7743682e028b4ace949c5ff6dc7eba014f9af03bc9fa05a84fcd1d70a

SHA512
0d92326ed252ea040ebc76cfe7a85806efc09ae1b3fedce5c09c47d61d2a63a22c4bedcd12c0db7e575d12edd76aa393502cd108529eb701c1f2af2ae911741a

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_gu.dll
Filesize
41KB

MD5
43942ef9e24eef7239e8e9b7b17427b1

SHA1
49df0f0dbe61cf107f5b8df08f163181afdeda50

SHA256
1627f531c95a9780507953898b5d71910dad80bb0f17144e4ee8e1b6f6c85fd6

SHA512
63901da157470e430bf460faa9d30e70a81b702749e8f4dbc5cea30ff0e70c2628d69b0fad452f77df8e2e6651d6c4662a2d69fa5f79a47dc159e24b9242b70c

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_hi.dll
Filesize
39KB

MD5
4490ab465b39d3524a61fe78a6407c98

SHA1
59d76925f8c76f1d6ae5ced82e3e4a0f26b67c7e

SHA256
2605a5f05ee2d2eb6a9a94f2ef695334cb2edbf7e721dc631161b9163288a73d

SHA512
10abfb16e06f47e139b1e1a1774763d3bb9f631b93a5ae375323d5348d9bd1f0daa28123c9dce5268e7cf74b9c75346b77cd4fcee8501629bdba4c35bd9f2c69

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_hr.dll
Filesize
40KB

MD5
0491a056e8819e253ef0e0b89fa16b96

SHA1
101fc020e339737f72a967f3b288868cf0056cff

SHA256
c71a7e66b6abfb2e092ae822f02128f65fd54b588656c82e218d3d21e667ca93

SHA512
298ad3e9b4e328052d53f2ac73b7511c7f049982405acd20a99883be5d5fb8ee3c85e0865c5fb62eef4920c42f8745db916c32d77a34751af6d81fcbf9ae0f24

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_hu.dll
Filesize
40KB

MD5
c37106b97be65db4f0bff889e2e0610d

SHA1
6444e0f41f674eecd4f9f75b4c240f2f3becfef9

SHA256
8f85ad5acf375aae3d3c2bf1ff126b3df5c394dd29bc7a8745c8aa8a663d816e

SHA512
d2df04ef9cbaccd98c23b72fb6283ca7c0956c94d615a803ff2d98adab7883125fc16e534af88b9b116f0ebc63c8ec2106723e6011da7354dbaf3fd23cab90a3

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_id.dll
Filesize
39KB

MD5
7013cc13f670fbcbaf85a1afcb54f1db

SHA1
b95812583e8119d112d279e6978ad4757f6478f6

SHA256
4a753baaee7815039f0f221cf874550581b0648438a843a3a1b24aebdcac934a

SHA512
389bf8d2b5d31d2e1ba96e615e1cefb568ee502610c2c9d855276173aeaacb366c642d3c676cb58015cd96118a04fb74f1a995e01de79f25daf8b2ac52197b0e

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_is.dll
Filesize
39KB

MD5
8e7c4562d57bb8ed4bb7a18e4d60aee4

SHA1
d1305bb62c6e4801e0fcad84f840e47caee49cef

SHA256
6e0f1eb6978adb15ffc55dbc4594745814ace046534a344e83c0d926ba39fd48

SHA512
251bc524c31a71c4d893499b868eab1a14daa32107d4de1d8f68512486c0990b9f850db16bd4c0b1895942acade381f9e8b485b551286988eadfd7cbfd65dc6b

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_it.dll
Filesize
41KB

MD5
809bc4efea05d16ac6b31e8e0e822848

SHA1
20793d89c9e6173ec5f2414129a22c6050790a75

SHA256
c09b0b2998700c83872c4ae41042c5360830351066fa0d97e702757695d1dedb

SHA512
3e24705f4da8b6c15a840caa2565c2d3480a2fee8d7b1ecd0dc2ee34198231784df69c3f924ca0f1783079890a3810f3fa64860101c9ff23115a212e5caf5165

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_iw.dll
Filesize
37KB

MD5
bcb0f5bf20549250c666f6c210eb9080

SHA1
8dc41a04d15be5d292f9434cba2a75877593a28b

SHA256
e22130efcc8038a8b20aec27758092ea5804ddc4a42c94baca009776fcd55035

SHA512
1d3b9bff07f8d86612e186f124bf06555d39bb8967f83a353b1341c81aca1bf19cdaa0c45b325f183921194b81a248434fc883f1e512715fd70421dcc458f1f8

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ja.dll
Filesize
36KB

MD5
ad0092f00535fd4b63cfdf772dbb0365

SHA1
3260293204dbe52b9a2d89c2e3e9e4f4edfc97bc

SHA256
e66fc74c419d74ef47cad41fff49197a37bfd2ac77fa948424ce4defd5028378

SHA512
7eb20906a4ec914d53e36259c011de9a9bffffc9b3f9bea5e11a54697233b01c169e7d06a310254e6dccfc7ae34ee1d54514041815c9a01f9b47c1305d34f8f6

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_kn.dll
Filesize
41KB

MD5
4e6c68b6d7e7446969dac4f97ba29d9b

SHA1
3e7ffb54a2d3bee343b38f13b7a018b6a0486bee

SHA256
2d32598548c5fa89dda25d350183d429e40cff63fcb5e3400826d87af19dd219

SHA512
e3b65878bd5ba48923d280b57c297ebba16fdce72934ea7f415ab52b0c5731e9d71a659047120eebd9e8f3f0d4c6af13edfc30af964408f7c28a5e9af363dba8

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ko.dll
Filesize
35KB

MD5
534c25868aa75ac0708fd1d861169166

SHA1
8f888b113d24d2adadb893ffaddc09ab7b9bc517

SHA256
784662c6d4eace25f9be687618ddc21e71498a8bb37c85d5da7c28ae0fb1ae42

SHA512
4ecbf0c15d9714d5c6b39e03ca13709c2ae2fb2d69541c1cb64027eea9715e5a4f2be88159e31640c45ff9afbf7f93d137c7a7a2e7c21a2a6d8ee84f33793c03

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_lt.dll
Filesize
39KB

MD5
fcd4362eed0f293fc79ef14072f61a6e

SHA1
bf20bfda1816c9ccc610c4684e186f76fa09df5e

SHA256
0c5b13a17d780dbb1cb0316f2f88d824ef8b93cffe587ffde8eb219a24d03010

SHA512
4db133b5fed24799d1e3782b57971ec332bd868681356529bb2080876d99e9338995287a179ade76348f73141f0ffb7ebdd1accf276e8c75aafbe1034e01ac7f

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_lv.dll
Filesize
40KB

MD5
aba3a491bb97ce4ff56306793b4e9dc9

SHA1
23fa01810ca7c4a01e2fb03e0a24877e54e662f9

SHA256
c2ab48114bcde313262ad18e848a5d42e2781f862fec4e02bb50fb32fac21095

SHA512
29b18e3b7223c87ccea599c7b491fadc67cd2f8bf1c407475baf3cabfc176056438a92aa7fb892ba561ccd19d305e072cd1837496247a3d1a276caff20cb4612

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ml.dll
Filesize
42KB

MD5
449dc4eb28a9bcdbc2a10e6dc98aef90

SHA1
06e5b9bd1dc2fd4eaba313bd28ea4b7b2c6affbb

SHA256
b2cbd8c3db77c63c285a64be30808ff17fb74dd1e5ce3edd4fb4af697d9b1356

SHA512
50df77f526baec4e6611637a9e35540e5d275711c69a62dcb4c58e56bbd9c61935faf367ca4c7c787049194daeca86c6d3a019346a1a724663a23da76878ead5

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_mr.dll
Filesize
41KB

MD5
0d74faee97b70f64bf6cdae92e46c282

SHA1
c21bea52c9f61dac999720af7572d004bf3db2fa

SHA256
a5c5094552cd2120c9b50652fd5887081cc6bdae9955a64c4777281dc813f331

SHA512
21057a2c354f5b1ea02e3b7a0f7f17c03da0c85590e851010509634335ccf259bfe1ef30a8940c265abc22c8c9b0e44d90f942a22879840b0dc062efd2be3c54

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ms.dll
Filesize
39KB

MD5
57c2d467da78e94163930f6714b62220

SHA1
4214935114aac67121ceec1f5c8b219708f249e9

SHA256
6d08e6ea51f4441fc562b81c4f78aa29e53403f3aea8b02e71d0e0ba9cda2029

SHA512
501998aa8749a6c4e7f182f33f7b20e1d2f5eb75033dda3cd55bab7420de2c531ddc4fab284559b4656d10f56e0e3afadc725df96f536f067bcf2f5887c2fb84

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_nl.dll
Filesize
40KB

MD5
57bb36bd2b3c666b6c9bda08b6270506

SHA1
ab702e5661c321c17b2e0fe5d546871d094d2c8f

SHA256
66601ed0b8883ea6fc5fa6efd79b4355c32d42c7162829b08aa1c4d0ced64474

SHA512
9dbb11c18af9980c044d59fc8167bdbba88099c9b75bf46e6441c503a4b734cf19be1415051e448505dc3511b3662a7ec2d3932f033f5a098203eff831a59c83

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_no.dll
Filesize
39KB

MD5
663791529c5efaa6f2b3aa3379613ed2

SHA1
605d0a92ebd45bcf997f44957332ca3b08e0a09f

SHA256
6665a7ca80fb2fbf5557f2f3b0b752e4110a412a4f2a2fffdfa8f97bbe140b41

SHA512
18dfa19d2d66646be82c928d7a77fb4df806ad5875c7257b804f149fad828d81f9629c59b3905bbbe40f7a3b4d70f09249268b9896b6040bf027cc1bcad52759

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_pl.dll
Filesize
40KB

MD5
613962f8deefc367a25338365d466215

SHA1
a30fb61af3797ad286e352b0c327f6dca6e601f0

SHA256
45a58376b0a2bd6ed7d46bbe1a5de2b443a29eee139ee1c37754f269f9013b53

SHA512
740024c38330ab906ee34ec888f33e6a3a4542f521193a2242e285fbf2e435e5893c8819c5b8b8b0ca7f2612cdb7f15499401dea76fc4d6034121677f938f99d

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_pt-BR.dll
Filesize
40KB

MD5
7608bf0e929799c281a5082b56fd69cd

SHA1
6dda7d7ae63a6b4a4ee1ec99bcf1d924736957ec

SHA256
f2c764c556ebdfbaa246e37a23f873525ca0ff1f5d2fb42aa541c5baa325c2ca

SHA512
f270a69fab581d9c8265206e999bfd8d4eac0ee4a0db7e64190cd02ff627236030ea1d1d9c95712a3552792259783593d231f0d852dddda079f87d5aadf179dc

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_pt-PT.dll
Filesize
40KB

MD5
048053db8af54bf3412b741ac14caff4

SHA1
6c86671553b46d70650087e923eb653dacdf0352

SHA256
df98834c4494ba37f78b6f2388b17ce8f726c89deb0a55c0a3d26e8ccd52de1d

SHA512
4b3c01ef98edd117516b6374afc182a358066676afcb2d29f418562867799822bca305fb6920ca0daaf5a69c46f12701074e76b9643af882959db5815254ae1d

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ro.dll
Filesize
40KB

MD5
05762cf574d5f7e7780365b255d635e0

SHA1
3bd3a7289607581e2e2d060f8abe4b6e864f6007

SHA256
8edae227038336385adc7009be271839ced13693ed4e519cc13a5836b6be74f3

SHA512
72dd30cd39e0d9bc432214e368e58af7de1006d0913c6bf78dbfdb1b442b86d53af68afe2d934a5e770e7818edfbf6c9972361b88687998786cc69dcf58c7768

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ru.dll
Filesize
39KB

MD5
36135ed19ac4fa31a1de825c366b572b

SHA1
5849281550c128e909a1415eb5455339551703e4

SHA256
b42ed63865d88e4972e83708352dde90c3f4e3ecf317b37a0df7173ab8fa5220

SHA512
392f891c50e95a8cc888f34f40faca82c16ab6de4f94d4167e6e398084390a5b2a6826a08903cab6fd9f77abdda55cc2e4b1c5766a109d566ead263f4d76153b

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sk.dll
Filesize
39KB

MD5
1fcb769e36c2923c218ad11e56672545

SHA1
ae0028d4ea7ed5771103300ccfeb50d61fcbb682

SHA256
3608e6576b2b204aa2bd0d82cf8793adfe97ef5415eaa8f84d4066deb8af274c

SHA512
3e511ca4d573de3f8a3a535b9772735f7a720f4f04e477c29d280e73e37a826bc4411544478eac4963288e69be4daa9de497d696bd15741b83e118be16d052ff

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sl.dll
Filesize
40KB

MD5
5938dd2722e6fd07cf7aaf5b31083a5c

SHA1
b6f66ac2046532392f86a22a913277dd0c405fa9

SHA256
80c48f045d55759ac1eeb9b5ffb2143dc16b3604fb0a70015bf1f169c40f6635

SHA512
878a503baa2d187cdd860b8b6c2e6b5a21357b0eaa4d54038f5c976061c1151a577094c9a7450b66f8a88bcc4a20718bfaa46f987a4546d1220b5ea041dce77c

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sr.dll
Filesize
40KB

MD5
685a4ab23f7922381c0f6bc345f065c7

SHA1
c99206c19c73d1c8552fd1845bbf1979e9bc52ce

SHA256
c8dcea937316ccbbf81041b18d63e6ce5d5a5f88ebf81f522f723b92dc1803de

SHA512
dff7db97f20235eb9d6b5eefa41a16d83b0e7c066747efeb1afc9c6bdf288ca6d285c052e5122dd9a6fabdf2f0a895e63039632137c2bf43ad15fab2648a9034

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sv.dll
Filesize
40KB

MD5
39f7b88d687a8d6ab336031c149beb76

SHA1
e4c6e9418ee5cc0d66b4cd03cd148d8c1a1bdd49

SHA256
e56df56216f9dd0be70fcf5476d59c54219263ff4735121cda4516075dcca95e

SHA512
ce16adac7dbdaf293ab4bcf29398750588c589159cc78c17532f21247e2a3a99e9c25bb10fd3df455fe94bfbba334bf7a2aa87477b7f5ac15e565e1d91c36d29

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_sw.dll
Filesize
41KB

MD5
7ecce68dde93b9c3192426ad14f3c125

SHA1
87b4593c8c70f192e1479d0577f13d0e00f31a3b

SHA256
823f10c05156a7e70a3a067a0c251e62d0a5afb462cfcdd5d80f8323310bfba0

SHA512
f709e0956b1eaafcf157f10e46c7543c039742d184930b8a4943510bee3c4a8d62ebabf11ebd1c57a231ef82ab138cf2f3bba13900612e70e9af5677c7a4e0a8

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ta.dll
Filesize
41KB

MD5
058431a076103b070d0712723dabd9b3

SHA1
1a7887ff21a1b592464591c952611d9e1466339b

SHA256
73387fa549ac49b37fee3a055425d268e6c42c28790c2229ef6a5af77f86762c

SHA512
98eefe27c4c13b7a2f574bf1d6ad337051a61dbfd30b9952df612c0e0b7b8263766eb1eea49f7d7da7841172a1643beacfa2824118f22bdad3eab588e1426857

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_te.dll
Filesize
41KB

MD5
b947f307800156b11c1ecaaa77aa2a89

SHA1
4c7442849b2c4b036cc91e5818a588173ba651bb

SHA256
2ed78b27397cc0ebe44e5759a85770206bb84d2c3ff9678f95ebe17eaa5ad81f

SHA512
a791b4b6088f95d2ddae0a5a7a5004d3d6cae2a17ab7cc116dbc7cbd005fa990dc04f09ead9096d1ca04c3add02bf5245d6805e3a5688a3f7a0b37bc9d2fd2fd

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_th.dll
Filesize
38KB

MD5
d328c70c4f489313265e396086dda43a

SHA1
69e6db8e0fc55bbb361e6647dda57292fc79e877

SHA256
0157951bc034829cd87f08a486b7634861246133c2718665dd408bcef935b7c8

SHA512
db82be5252200438ca4acc55809e29d5b098b8580147fe16aa1defe8e36058381602f8026e6e412e765941f5d1c7650ae611af623c00d835d1e107c287af8a73

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_tr.dll
Filesize
40KB

MD5
a2a7f16ad5b842bb78be30f1192ee353

SHA1
f86e301e6bce748e712fdf466d5b4472942d7005

SHA256
416843d52929df9513f2317bf71e50688f6473a090f6bf29194814557ec227bb

SHA512
2cc75aac0581b644f5b00858237f956084e5f633bf629204cb184ac4520754304c10cc2adaadd66ee27750193fe1c1f49966b2aef59c80fd86eb1dcd144e85cd

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_uk.dll
Filesize
39KB

MD5
b13f048d65cc8c623d9f96e84574c3de

SHA1
b1d7479427cf3cc3f1aaad93aabf12e87fdb10d7

SHA256
66f737b68940888974937cb23380fd165e07bb666424f8a87dc0a261fca60729

SHA512
b8667b74dc9437eecd516de226b870e3b4a02affa2a47fd90b5bdc6f57cf960f530bfc63ff3e00d5beef07af85554ebcaa42544fee91a229aea531885165e2ba

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_ur.dll
Filesize
39KB

MD5
45967d9a98b0936b5c74cd6bdd06437a

SHA1
687be3316863622a99475d9cbd9731c11d4e371e

SHA256
f9537c443e402df36ef17fa888aed4328dde46c12739e1c3a07c13f4e0219fa6

SHA512
ab92d767027120bad7865ba3a877e5510522ea62cc2cb1c48812ffed0f45d7aec25db74eb1348cb04826af6bb99183a60dfc1717469963245b60f23c0717b191

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_vi.dll
Filesize
39KB

MD5
5874bb0f7baa6879d86b5ae468f4391f

SHA1
dd4b3da86a5c7916e3f64d69db41fcf0799c254f

SHA256
7e39a4ece3d3bbbb269d4d56c6e20a4ac65ace0c5834e7df94740cbc5aae9ecb

SHA512
b35e5f6581b248ba1e9b1a2464990bb5b623c800bcf83e5869c6c501dc2109fd19f682289ca9dfa95a2b6fb8faa2f61404fb25a36b9d847d4aefeaff404425f7

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_zh-CN.dll
Filesize
33KB

MD5
2c7802fde630f6a1e5571c6e0ee37282

SHA1
c21a445dbefaf87325d61bbd3c86a66c61fc8b1b

SHA256
e035d01faa42a2bfdb5b789d9c72358f7248fd40384ea0aab7c4a44d3f077c8c

SHA512
6a7133ad8da330d00b8525bafa7ea9ce64b055c49184fc3ac8586c676cff6b36bf9d04d9af91e8eae7710310def07eff7855ab44d71ecc9875de61556d15d313

Download Submit
C:\Program Files (x86)\GUM7CD6.tmp\goopdateres_zh-TW.dll
Filesize
34KB

MD5
31d2f7d0f23bc335c3f4e79e0b329699

SHA1
74d745eb4a698c4844325d85459485c0776c3237

SHA256
8392ce738e66baed35d86e5c0279e1c786f54ee2baa3e37944c763fe01a4884e

SHA512
9184f48695fe2bcf1d102f5cc2b95071f688a30103dab10488833f638758953a34359a2dd2e1bf2716ebeef18dbfb30d3f0f4e8963709fdc7814af9b9013952f

Download Submit
C:\ProgramData\CheckPoint\ZANG\Logs\Install\DropInstaller.log
Filesize
2KB

MD5
b70de64f33ee92a0f6c47487802555aa

SHA1
546f4da5f605b5ad2998ec5f4efc360430f958d7

SHA256
119c87ef50a49ccdbda36f41d58dedab3ec69dd40708fcf37e62a214b80f3c76

SHA512
e2d826ee6295a8e59481d99a09a14e45090c8d1fb0688f9b735e32580168707e88c33527b72c5557e839331bbaabe5783d5b0a07458b0e209375c3dfa3a4f24c

Download Submit
C:\ProgramData\CheckPoint\ZANG\Logs\Install\DropInstaller.log
Filesize
2KB

MD5
b70de64f33ee92a0f6c47487802555aa

SHA1
546f4da5f605b5ad2998ec5f4efc360430f958d7

SHA256
119c87ef50a49ccdbda36f41d58dedab3ec69dd40708fcf37e62a214b80f3c76

SHA512
e2d826ee6295a8e59481d99a09a14e45090c8d1fb0688f9b735e32580168707e88c33527b72c5557e839331bbaabe5783d5b0a07458b0e209375c3dfa3a4f24c

Download Submit
C:\ProgramData\CheckPoint\ZANG\Logs\Install\DropInstaller.log
Filesize
2KB

MD5
00b38f49f5e72f95e0c1f6aac9f3ef98

SHA1
3850ce5f4c5949a300562e6150eddb9b7c309975

SHA256
8b5a74f4718c1ae4d6ad0563545e89409dd25a98a69f0341beb01cd45e3b31c3

SHA512
b5afbcde154250a3d02d04bfc37fded0e8fd2d85fda4c5c214d153d7fc7f16e736cac95d96039b202815c8c0ea50add918a6912ebcc65601985cdb1b0c0f7c12

Download Submit
C:\ProgramData\CheckPoint\ZANG\Logs\Install\DropInstaller.log
Filesize
4KB

MD5
7bb66f8a16b35abd66b0c967aeed5508

SHA1
eccf443b79a26d9cb951e937a80c44f66ed516c7

SHA256
4a7fcb5e454f3b6af59c0b012d53a70af2b859c7d835fbf3e4f3469edc1af260

SHA512
fab62acc6765c8f11585e3145830c382905899544187d9c81e88f6148d3e798686b926a0538785258e990176eda6965fa85b4676ec55a1b86b46fb7c549228d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc1965.tmp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit