Analysis
- max time kernel
604s - max time network
632s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
14/02/2024, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
EPS_2024-02-07T09_33_38.108_V87.52.2005.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
31 signatures
600 seconds
General
- Target EPS_2024-02-07T09_33_38.108_V87.52.2005.exe
- Size 520.8MB
- Sample240214-j9sqcaef77
- SHA256 2bb8b561a0c0ad6c1d049f5bc3fad745fa4ac45af5a949d850c75659f438a559
- MD5 90d7e12627f6c990a7c38b29cf6dcd08
- SHA1 a20a2b457b0ffdf7cd9f3a801c3451bcf4731fba
- SHA512 4f8d5149ab41c82d507b3a80fe3702da3521e8663dd3b98c39ebc9614d5111860faf4ac3fa34447f0c1c4c9908d1c0309d3d84edec35fbb6275d6671c6e0c258
- SSDEEP 12582912:zAd65ZkQL+wCPOMH3u/JnOTHkVaQDX1g8fG/WHQ/VGCPQO:085ZH+1OMXuGHkVaQRg8+/WHkVtPQO
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Creates new service(s) 1 TTPs
- Drops file in Drivers directory 31 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\SET570.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET3327.tmp vsdrInst.exe File opened for modification C:\Windows\system32\drivers\epelam.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET3E9.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\epklibproxy.sys vsdrInst.exe File created C:\Windows\system32\drivers\ccore64.sys msiexec.exe File created C:\Windows\System32\drivers\cpepmon.sys msiexec.exe File created C:\Windows\System32\drivers\epklib.sys msiexec.exe File created C:\Windows\System32\Drivers\IntelTDT.sys install_tdt_driver.exe File opened for modification C:\Windows\system32\DRIVERS\cpbak.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SET447.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\cpdiskflt.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\vsconfig.xml vsdrInst.exe File created C:\Windows\system32\drivers\epnetflt.sys MsiExec.exe File opened for modification C:\Windows\System32\drivers\vnaap.sys DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\CPEPMon.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SET3327.tmp vsdrInst.exe File created C:\Windows\system32\DRIVERS\SET3E9.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET447.tmp MsiExec.exe File opened for modification C:\Windows\system32\drivers\epregflt.sys MsiExec.exe File created C:\Windows\system32\DRIVERS\SET4F3.tmp MsiExec.exe File opened for modification C:\Windows\System32\Drivers\IntelTDT.sys install_tdt_driver.exe File created C:\Windows\system32\drivers\cpdevmon.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\SET4F3.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\cpdhnypt.sys MsiExec.exe File created C:\Windows\System32\drivers\epregflt.sys msiexec.exe File created C:\Windows\system32\drivers\epelam.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\epklibproxy.sys vsdrInst.exe File opened for modification C:\Windows\system32\DRIVERS\vsdatant.sys vsdrInst.exe File created C:\Windows\System32\drivers\cpbak.sys msiexec.exe File opened for modification C:\Windows\system32\DRIVERS\SET570.tmp MsiExec.exe - Blocklisted process makes network request 6 IoCs
flow pid Process 54 2792 MsiExec.exe 56 2792 MsiExec.exe 58 2792 MsiExec.exe 56 2792 MsiExec.exe 54 2792 MsiExec.exe 58 2792 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\NoExplorer = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} TESvc.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EFRService.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epam_cli.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmrunmanaged.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Troubleshooter.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SelectUsersSrv.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EP_CDT.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmdci.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwcli.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpinfo.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CpInfoPreboot.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallDeviceFilterDriver.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\STDeploy.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MemDump.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpvinfo.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TracSrvWrapper.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TestScan.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HotspotApplication.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CheckConnectivity.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtScanMon.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ServiceRequest.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HealthChecker.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavecscan.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cppsm_tool.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProtectionTool.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPNetUpdater.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logProcessor.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trac.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARCleaner.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAEon.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lqmireg.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WscHelper.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TESvc.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epam_svc.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install_tdt_driver.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswdc.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswdc64.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epwirfix.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DriveSlavingUtilityCLI.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FDE_Drive_Slaving.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdat32.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CPEPNotifier.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updsdksample.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IDAFServerHostService.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\openmail.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update_config_tool.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epab_svc.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CPSandBlastBroker.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UINotify.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpefrcli.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TestMon.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hepctrl.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPN_ProxyServer.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DAAW.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwcli_7.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRSValidator.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updsdksample.net.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wkhtmltopdf.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmdumper32.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmdumper64.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPS_LogViewer.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBASignatureUpdater.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cptrayUI.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmguardsvc32.exe msiexec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation EPS_2024-02-07T09_33_38.108_V87.52.2005.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5d0a7755-98e2-6f4c-9a0d-cee65ad47512}\vnaap.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vsdatant.inf_amd64_bb11170823f9d0c3\vsdatant.inf DrvInst.exe File created C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\vsinit.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_364712BBD9943C1C51A5744BC7D0DAD8 TESvc.exe File created C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.PNF vsdrInst.exe File created C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\cryptocore.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\ZoneLabs\vsconfig.xml InstHelper.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C51.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\c_netservice.PNF vsdrInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cpda.exe File created C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5d0a7755-98e2-6f4c-9a0d-cee65ad47512}\SETF95B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C63.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FD71CFE79D6D7851B359F989AE50AE80_A10D388FFC2B3D08C0BDAB0B7ADF7E35 cpda.exe File created C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\cptmsender.dll msiexec.exe File created C:\Windows\System32\CPEPC_PLAP.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.PNF vna_install64.exe File created C:\Windows\SysWOW64\Zonelabs\VsDrInst.exe msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\lmx-MD-vs2017x86.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4B782275DC1682E4DC39E697A49B151 cpda.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cpda.exe File created C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\Zonelabs\vsdatant.inf msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 TESvc.exe File created C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C52.tmp DrvInst.exe File created C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll msiexec.exe File created C:\Windows\SysWOW64\FirewallMonitor.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.sys DrvInst.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\Conf\SHA256SignedLogConvertorSchema.50.xml msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\ReportTemplates\fails\images\menu\remediation.svg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\CPEPNotifier\Resources\Compliance_Info.png msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\it-IT\EP.URLF.Logic.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\TElogo.svg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\sites\tesco.jpg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Resources\Images\Drop-Down\Level1_Arrow_open.png 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\blade_icons\AM\Delete.svg 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Skins\Default\Stylesheets\Images\MCSlider_loader.gif 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Reputation\ReputationProvider.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\pl-PL\EP.DocSec.Logic.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Endpoint-Clients-UG\macOS-Win-UG-Shared-Topics\Using-Logs.htm 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\ppam.png msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\sites\free.jpg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\res\progress_hc.gif msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\_locales\nl\messages.json msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Drop-Down\Drop_Down_Large_Arrow_Closed.png 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\blade_icons\URLF_disabled.svg 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Data\SearchStem_Chunk8.js 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Master-Page\HTML\favicon.ico 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\el-GR\EP.FDE.UI.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\Microsoft.Office.Tools.Outlook.xml msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\usercheck.html msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\doc.svg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\cancel.png msiexec.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Resources\TableStyles\TP_Table_Text_Box_Outer_Border.css 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Search.htm 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Data\SearchStem_Chunk1.js 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\grey_icons\10.svg 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\UserCheck_files\UserCheck.css msiexec.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Resources\Images\Important-Information-Page\Important_Information_CPVersion_and_More_Information.png 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\cptrayLogic.exe msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\Severity\SE_Severity_High.bmp msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\fr-FR\EP.Common.UI.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Skins\Default\Stylesheets\Images\arrow-up.png 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\uk-UA\EP.EFR.Logic.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\Microsoft.VisualStudio.Tools.Applications.Runtime.xml msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\sites\icloud.jpg msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Endpoint-Clients-UG\Topics-EP_Security-Client_macOS_UG-Obsolete\FAR-Options.htm 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Skins\Default\Stylesheets\Images\icon-user-light-gray.png 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Glossary\GlossaryTermLinkExpandingClosed.gif 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\MacroFeatureExtractor.dll msiexec.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Endpoint-Clients-UG\Topics-EP_Security-Client_macOS_UG-Obsolete\MEEP-Components.htm 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Images-for-Del-05-EP-Client-Windows-Help-UG\EPS-new-UI-protected.png 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Resources\Scripts\require.config.js 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Logic\EP.DLP.Logic.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\blade_icons\AM_2_disabled.svg 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cpprng.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\usercheck.js msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\AntiBot\epab.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\it-IT\EP.NAP.UI.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\zero_phishing_contentscript.js msiexec.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\recovery 7za.exe File opened for modification C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Drop-Down\Level3_Arrow_closed.png 7za.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\pt-PT\EP.FDE.Logic.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\bin_analyzer_dll32.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\Conf\SHA256SignedLogConvertorSchema.48.xml msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\dot.png msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\TopicIcon\Big_Medium_Risk.png msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\deep_flow.zip msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\comparisonChart\cc_total_received.png msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\fr-FR\EP.ServicesUI.resources.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\CommonDLLs\EP.CommonControls.dll msiexec.exe File created C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Endpoint-Clients-UG\macOS-Win-UG-Shared-Topics\Anti-Malware-Ransomware-Detection.htm 7za.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI57B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI580B.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\vccorlib140.dll.8A193A94_BCB6_303B_8ED1_C099302B9194 msiexec.exe File opened for modification C:\Windows\Internet Logs\ cpda.exe File opened for modification C:\Windows\Installer\MSIA79F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA9C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6922.tmp msiexec.exe File created C:\Windows\Installer\e592179.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\mfc140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\mfc140u.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\msvcp140.dll.8A193A94_BCB6_303B_8ED1_C099302B9194 msiexec.exe File opened for modification C:\Windows\Installer\MSI38FD.tmp msiexec.exe File opened for modification C:\Windows\Internet Logs\tvDebug.log InstHelper.exe File opened for modification C:\Windows\Installer\MSI851E.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212 msiexec.exe File created C:\Windows\Installer\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Internet Logs\tvDebug.log cp_InstPrep.exe File opened for modification C:\Windows\Installer\MSI3A38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI518A.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\msvcp140_1.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File opened for modification C:\Windows\Installer\MSI6BEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2167.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\mfc140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\mfcm140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\msvcp140.dll.8A193A94_BCB6_303B_8ED1_C099302B9194 msiexec.exe File opened for modification C:\Windows\Installer\MSI85FB.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI4F0.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\mfcm140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File opened for modification C:\Windows\Installer\MSI8471.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C msiexec.exe File opened for modification C:\Windows\Installer\e59216c.msi msiexec.exe File opened for modification C:\Windows\Installer\e592171.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B msiexec.exe File opened for modification C:\Windows\Installer\MSI39F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA9A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7D3A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3E4F.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\vccorlib140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\vcruntime140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File opened for modification C:\Windows\Installer\MSIF3E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF450.tmp msiexec.exe File created C:\Windows\Installer\e592170.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\vcruntime140.dll.8A193A94_BCB6_303B_8ED1_C099302B9194 msiexec.exe File opened for modification C:\Windows\setuperr.log MsiExec.exe File created C:\Windows\Installer\e592169.msi msiexec.exe File opened for modification C:\Windows\Installer\e592169.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\concrt140.dll.8A193A94_BCB6_303B_8ED1_C099302B9194 msiexec.exe File opened for modification C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\0ECBE1120F1AC664ABB4EE0DE257AB5B\1.0.2212\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C msiexec.exe File opened for modification C:\Windows\Installer\MSI6FE7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI395.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2447.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\msvcp140_1.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\89173B7063DBFDC4F8A0C1388D3574AB\1.0.2212\msvcp140_2.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3 msiexec.exe File opened for modification C:\Windows\Installer\MSI4C0.tmp msiexec.exe File opened for modification C:\Windows\Internet Logs\tvDebug.log cptrayLogic.exe - Executes dropped EXE 37 IoCs
pid Process 3984 MSISelector.exe 2356 cpmsi_tool.exe 2092 cpmsi_tool.exe 2388 MSI6BEA.tmp 4668 InstHelper.exe 5112 MSI8E0A.tmp 3076 UINotify.exe 644 vna_utils.exe 2360 vna_utils.exe 2524 vna_install64.exe 4464 vna_utils.exe 2128 vna_utils.exe 2820 vna_install64.exe 1724 install_tdt_driver.exe 5068 UINotify.exe 3728 cpregsvr.exe 2204 7za.exe 2112 cppsm_tool.exe 992 cppsm_tool.exe 3620 vsdrInst.exe 4932 7za.exe 3452 MSI75D5.tmp 4008 EPWD.exe 4568 epklib_tester.exe 2416 cpda.exe 2604 IDAFServerHostService.exe 3660 Compliance.exe 1120 TracSrvWrapper.exe 2868 cptrayLogic.exe 4136 TESvc.exe 4648 DAAW.exe 4820 cp_InstPrep.exe 2628 epwirfix.exe 964 DAAW.exe 632 MSI581C.tmp 2228 MSI580B.tmp 3320 cp_InstPrep.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 404 sc.exe - Loads dropped DLL 64 IoCs
pid Process 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 4668 InstHelper.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 2792 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 3076 UINotify.exe 3076 UINotify.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 5080 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 4640 MsiExec.exe 5080 MsiExec.exe 5068 UINotify.exe 5068 UINotify.exe 2792 MsiExec.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe 3728 cpregsvr.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID vna_install64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags vna_install64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ vsdrInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 vsdrInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 vsdrInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs vna_install64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 vsdrInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs vna_install64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 vsdrInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A vsdrInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008bec060def88e6600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008bec060d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008bec060d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8bec060d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008bec060d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom vna_install64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vna_install64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID vna_install64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs vna_install64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ vsdrInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A vsdrInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\ClsidExtension = "{C0E8AE32-0758-4C8D-AB71-23B361FE8964}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\ msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\CommandBarEnabled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\MenuText = "Check Point Harmony" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppPath = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\SandBlast\\" TESvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppPath = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\SandBlast\\" TESvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\Policy = "3" TESvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\CommandBarEnabled = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\Icon = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\SandBlast\\\\data\\icons\\CheckPointLogoHot.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppName = "CPSandBlastBroker.exe" TESvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppName = "CPSandBlastBroker.exe" TESvc.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\HotIcon = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\SandBlast\\\\data\\icons\\CheckPointLogoNormal.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{C0E8AE32-0758-4C8D-AB71-23B361FE8964}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} TESvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppPath = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\SandBlast\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\AppName = "CPSandBlastBroker.exe" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{C0E8AE32-0758-4C8D-AB71-23B361FE8964} TESvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\ButtonText = "Check Point Harmony" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\Default Visible = "Yes" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\MenuStatusBar = "Check Point Harmony" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\Policy = "3" TESvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0E8AE32-0758-4C8D-AB71-23B361FE8964}\ msiexec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Trust cpregsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs cpda.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root IDAFServerHostService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs EPWD.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates Compliance.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs TESvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs cpregsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates UINotify.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates EPWD.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs UINotify.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA cpregsvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs IDAFServerHostService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs TESvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\Blob = 14000000010000001400000040c2bd278ecc348330a233d7fb6cb3f0b42c80ce4b0000000100000044000000320032003300440045003900360045004500320036003500300034003600390035003700410036003600300045004400370043003900440044003900450037005f00000018000000010000001000000021d008b47b7a2a81c8435903ded424c95c000000010000000400000000080000190000000100000010000000ce63bdc595635c1c37b040b4e554bf560f0000000100000020000000f9ff37f02e632cb7387025c07e57908a3d371b7c95d8cdd0390de231ed943a1204000000010000001000000096c25031bc0dc35cfba723731e1b414003000000010000001400000027ac9369faf25207bb2627cefaccbe4ef9c319b82000000001000000d4040000308204d0308203b8a003020102020107300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3131303530333037303030305a170d3331303530333037303030305a3081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100b9e0cb10d4af76bdd49362eb3064b881086cc304d962178e2fff3e65cf8fce62e63c521cda16454b55ab786b63836290ce0f696c99c81a148b4ccc4533ea88dc9ea3af2bfe80619d7957c4cf2ef43f303c5d47fc9a16bcc3379641518e114b54f828bed08cbef030381ef3b026f86647636dde7126478f384753d1461db4e3dc00ea45acbdbc71d9aa6f00dbdbcd303a794f5f4c47f81def5bc2c49d603bb1b24391d8a4334eeab3d6274fad258aa5c6f4d5d0a6ae7405645788b54455d42d2a3a3ef8b8bde9320a029464c4163a50f14aaee77933af0c20077fe8df0439c269026c6352fa77c11bc87487c8b993185054354b694ebc3bd3492e1fdcc1d252fb0203010001a382011a30820116300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041440c2bd278ecc348330a233d7fb6cb3f0b42c80ce301f0603551d230418301680143a9a8507106728b6eff6bd05416e20c194da0fde303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e676f64616464792e636f6d2f30350603551d1f042e302c302aa028a0268624687474703a2f2f63726c2e676f64616464792e636f6d2f6764726f6f742d67322e63726c30460603551d20043f303d303b0604551d20003033303106082b06010505070201162568747470733a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010b05000382010100087e6c9310c838b896a9904bffa15f4f04ef6c3e9c8806c9508fa673f757311bbebce42fdbf8bad35be0b4e7e679620e0ca2d76a637331b5f5a848a43b082da25d90d7b47c254f115630c4b6449d7b2c9de55ee6ef0c61aabfe42a1bee849eb8837dc143ce44a713700d911ff4c813ad8360d9d872a873241eb5ac220eca17896258441bab892501000fcdc41b62db51b4d30f512a9bf4bc73fc76ce36a4cdd9d82ceaae9bf52ab290d14d75188a3f8a4190237d5b4bfea403589b46b2c3606083f87d5041cec2a190c3bbef022fd21554ee4415d90aaea78a33edb12d763626dc04eb9ff7611f15dc876fee469628ada1267d0a09a72e04a38dbcf8bc043001 cpda.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates TESvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs TESvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs vna_install64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs cpregsvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ TESvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates TracSrvWrapper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs TracSrvWrapper.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cptrayLogic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs UINotify.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA cppsm_tool.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs IDAFServerHostService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs IDAFServerHostService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs cpda.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D89D4098-6DF6-4ABD-B971-5D151016B4E2} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2AD1AF48-147C-4AB8-850C-4DD253AAA328}\TypeLib\ = "{36721F97-744D-49C6-A339-75735A7A5641}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99D21D7B-915C-4336-A1BF-4717B3F213FD}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99D21D7B-915C-4336-A1BF-4717B3F213FD}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\daf_logger.DLL\AppID = "{66AB8C3F-9F2B-4496-A8BF-CDBD51EF8874}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D8C0084-DFA1-40F9-93EA-C13A2428C36B}\ProgID msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0ECBE1120F1AC664ABB4EE0DE257AB5B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E6B7CF8-40F9-11DF-93C2-B53056D89593}\ProxyStubClsid32\ = "{6A9DA114-AF05-4B93-B1E7-A312002721B2}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D8C0084-DFA1-40F9-93EA-C13A2428C36B}\ = "BackupAndRestoration.InvokeBackupAndRestoration" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E330DE4-2A3C-4708-8F66-FDFA74A65AA7}\ = "IBladesInfo" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\daf_logger.DAFInternal\CurVer msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5344777D-A7C9-484D-9EEE-5B43B54DF464}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{528A27B2-DEED-42F9-99C5-EA8DF0974B44}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2EF5D99B-B790-476C-87B2-4F8FD1BAE909} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFFBA560-40DF-11DF-99E1-216855D89593}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4E330DE4-2A3C-4708-8F66-FDFA74A65AA7} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D8C0084-DFA1-40F9-93EA-C13A2428C36B}\ProgID\ = "BackupAndRestoration.InvokeBackupAndRestoration" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2AD1AF48-147C-4AB8-850C-4DD253AAA328}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96048823-CFED-4C5B-BBE7-4F5242C283FF}\ = "DAFInternal Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6C89D148-0718-4AC8-8BAC-631C1D1FC19C}\InprocServer32\8.68.75.2001 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7278AA8B-1B58-4954-A030-8A10A5C75EF3} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0ECBE1120F1AC664ABB4EE0DE257AB5B\ProductName = "Microsoft Visual C++ x64 redistributables for Check Point Harmony Endpoint" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F391148E-9A66-47C0-A907-A33D59D3D64C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BEF334-7FAE-470B-A313-1342EFA90D63}\VersionIndependentProgID\ = "PushOperationsClient.PushOperationsClient" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F391148E-9A66-47C0-A907-A33D59D3D64C} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CF709EE-FAED-43CF-9C8C-737E43A9FA39}\ = "PSFactoryBuffer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\DAF_dsm.DLL msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CommonClientSettings.DAFClient.1\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6A9DA114-AF05-4B93-B1E7-A312002721B2}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\daf_logger.DAFInternal\ = "DAFInternal Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8E5B258-2D4F-4B1D-9312-D001D7751994}\ = "IDAFMarshaller" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DB7FAE-5F91-4E85-8E19-079C1FF5F5C1}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0ECBE1120F1AC664ABB4EE0DE257AB5B\Version = "16779428" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE4930E4-BBF2-4578-9B1E-656C4FE111F7} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{36721F97-744D-49C6-A339-75735A7A5641}\1.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1DC7CBBC-3B1E-437A-BFB5-1333C6CD1626} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6E71F0D-12E8-4933-A0F3-93CAFA70461F}\InprocServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Endpoint Common\\bin\\PushOperationsClient.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D769984E-A802-465C-A813-54B8AEB97475}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152175C3-A91A-402E-9663-A2B25E308584}\VersionIndependentProgID\ = "IDAFServerHostService.DSMServices" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89173B7063DBFDC4F8A0C1388D3574AB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EF01E3C-4106-11DF-B1DD-E89156D89593}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7278AA8B-1B58-4954-A030-8A10A5C75EF3}\1.0\FLAGS\ = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23291788-C88F-4172-AB75-DAEE65AEC531}\ = "IDAFServer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{23291788-C88F-4172-AB75-DAEE65AEC531}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5F0BFCF-FAC7-4C5E-8411-08CC8A4700A6}\ = "IDAFServerComm" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\PushOperationsClient.DLL msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AAEC02E4-51F9-44B1-8957-022A23567FCB}\InprocServer32\8.68.75.2001 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0ECBE1120F1AC664ABB4EE0DE257AB5B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{4B7DA38A-124C-40C7-A71F-F098FC08304F}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6705C877-2AAB-4D04-9345-BBF05C03BE63}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFFBA560-40DF-11DF-99E1-216855D89593}\1.0\0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DAF_dsm.DAF_DSM\CurVer\ = "DAF_dsm.DAF_DSM.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6E71F0D-12E8-4933-A0F3-93CAFA70461F}\AppID = "{C98EDA3A-9EAC-4500-AF5E-2E92FD5DEE2B}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D6337126-9C3F-4418-88AB-1A135710CF5A}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{34894BE0-1050-4AB3-BA41-48C6FA7B0884}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23291788-C88F-4172-AB75-DAEE65AEC531}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE5820F9-ADA1-4B94-9A8E-5902CF872977}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{465DB11A-B20F-4C84-84B6-1EA5213D583A}\InprocServer32\ = "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Endpoint Common\\bin\\daf_logger.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8E5B258-2D4F-4B1D-9312-D001D7751994}\NumMethods\ = "4" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8E5B258-2D4F-4B1D-9312-D001D7751994}\ProxyStubClsid32\ = "{F8E5B258-2D4F-4B1D-9312-D001D7751994}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\IDAFServerHostService.DSMServices\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDAFServerHostService.DSMServices.1\CLSID\ = "{152175C3-A91A-402E-9663-A2B25E308584}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{F16AA208-540E-42E8-802B-7746F8D29D4D} msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd EPWD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f TESvc.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C TESvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e TESvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e MSISelector.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 MSISelector.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E EPWD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd EPWD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd EPWD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 MSISelector.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e MSISelector.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 MSISelector.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd EPWD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 MSISelector.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 MSISelector.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f TESvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 MSISelector.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 TESvc.exe - Runs .reg file with regedit 2 IoCs
pid Process 792 regedit.exe 3172 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 MsiExec.exe 2792 MsiExec.exe 2388 MSI6BEA.tmp 2388 MSI6BEA.tmp 2388 MSI6BEA.tmp 2388 MSI6BEA.tmp 2388 MSI6BEA.tmp 2388 MSI6BEA.tmp 2792 MsiExec.exe 2792 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 3076 UINotify.exe 3076 UINotify.exe 3076 UINotify.exe 3076 UINotify.exe 3076 UINotify.exe 3076 UINotify.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5068 UINotify.exe 5068 UINotify.exe 5068 UINotify.exe 5068 UINotify.exe 5068 UINotify.exe 5068 UINotify.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 5080 MsiExec.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 4008 EPWD.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 2416 cpda.exe 3660 Compliance.exe 3660 Compliance.exe 3660 Compliance.exe 3660 Compliance.exe 3660 Compliance.exe 3660 Compliance.exe - Suspicious behavior: LoadsDriver 39 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3560 msiexec.exe Token: SeIncreaseQuotaPrivilege 3560 msiexec.exe Token: SeSecurityPrivilege 3116 msiexec.exe Token: SeCreateTokenPrivilege 3560 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3560 msiexec.exe Token: SeLockMemoryPrivilege 3560 msiexec.exe Token: SeIncreaseQuotaPrivilege 3560 msiexec.exe Token: SeMachineAccountPrivilege 3560 msiexec.exe Token: SeTcbPrivilege 3560 msiexec.exe Token: SeSecurityPrivilege 3560 msiexec.exe Token: SeTakeOwnershipPrivilege 3560 msiexec.exe Token: SeLoadDriverPrivilege 3560 msiexec.exe Token: SeSystemProfilePrivilege 3560 msiexec.exe Token: SeSystemtimePrivilege 3560 msiexec.exe Token: SeProfSingleProcessPrivilege 3560 msiexec.exe Token: SeIncBasePriorityPrivilege 3560 msiexec.exe Token: SeCreatePagefilePrivilege 3560 msiexec.exe Token: SeCreatePermanentPrivilege 3560 msiexec.exe Token: SeBackupPrivilege 3560 msiexec.exe Token: SeRestorePrivilege 3560 msiexec.exe Token: SeShutdownPrivilege 3560 msiexec.exe Token: SeDebugPrivilege 3560 msiexec.exe Token: SeAuditPrivilege 3560 msiexec.exe Token: SeSystemEnvironmentPrivilege 3560 msiexec.exe Token: SeChangeNotifyPrivilege 3560 msiexec.exe Token: SeRemoteShutdownPrivilege 3560 msiexec.exe Token: SeUndockPrivilege 3560 msiexec.exe Token: SeSyncAgentPrivilege 3560 msiexec.exe Token: SeEnableDelegationPrivilege 3560 msiexec.exe Token: SeManageVolumePrivilege 3560 msiexec.exe Token: SeImpersonatePrivilege 3560 msiexec.exe Token: SeCreateGlobalPrivilege 3560 msiexec.exe Token: SeBackupPrivilege 2344 vssvc.exe Token: SeRestorePrivilege 2344 vssvc.exe Token: SeAuditPrivilege 2344 vssvc.exe Token: SeBackupPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeRestorePrivilege 3116 msiexec.exe Token: SeTakeOwnershipPrivilege 3116 msiexec.exe Token: SeBackupPrivilege 2452 srtasks.exe Token: SeRestorePrivilege 2452 srtasks.exe Token: SeSecurityPrivilege 2452 srtasks.exe Token: SeTakeOwnershipPrivilege 2452 srtasks.exe Token: SeBackupPrivilege 2452 srtasks.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3560 msiexec.exe 5112 MSI8E0A.tmp 5112 MSI8E0A.tmp 3560 msiexec.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5112 MSI8E0A.tmp 5112 MSI8E0A.tmp - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4668 InstHelper.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 3984 2948 EPS_2024-02-07T09_33_38.108_V87.52.2005.exe 91 PID 2948 wrote to memory of 3984 2948 EPS_2024-02-07T09_33_38.108_V87.52.2005.exe 91 PID 2948 wrote to memory of 3984 2948 EPS_2024-02-07T09_33_38.108_V87.52.2005.exe 91 PID 3984 wrote to memory of 3560 3984 MSISelector.exe 93 PID 3984 wrote to memory of 3560 3984 MSISelector.exe 93 PID 3984 wrote to memory of 3560 3984 MSISelector.exe 93 PID 3116 wrote to memory of 2452 3116 msiexec.exe 98 PID 3116 wrote to memory of 2452 3116 msiexec.exe 98 PID 3116 wrote to memory of 2792 3116 msiexec.exe 100 PID 3116 wrote to memory of 2792 3116 msiexec.exe 100 PID 3116 wrote to memory of 2792 3116 msiexec.exe 100 PID 2792 wrote to memory of 2356 2792 MsiExec.exe 101 PID 2792 wrote to memory of 2356 2792 MsiExec.exe 101 PID 2792 wrote to memory of 2356 2792 MsiExec.exe 101 PID 2792 wrote to memory of 2092 2792 MsiExec.exe 103 PID 2792 wrote to memory of 2092 2792 MsiExec.exe 103 PID 2792 wrote to memory of 2092 2792 MsiExec.exe 103 PID 3116 wrote to memory of 2388 3116 msiexec.exe 105 PID 3116 wrote to memory of 2388 3116 msiexec.exe 105 PID 3116 wrote to memory of 2388 3116 msiexec.exe 105 PID 2792 wrote to memory of 4668 2792 MsiExec.exe 107 PID 2792 wrote to memory of 4668 2792 MsiExec.exe 107 PID 2792 wrote to memory of 4668 2792 MsiExec.exe 107 PID 3116 wrote to memory of 5080 3116 msiexec.exe 108 PID 3116 wrote to memory of 5080 3116 msiexec.exe 108 PID 3116 wrote to memory of 5080 3116 msiexec.exe 108 PID 3116 wrote to memory of 5112 3116 msiexec.exe 109 PID 3116 wrote to memory of 5112 3116 msiexec.exe 109 PID 3116 wrote to memory of 5112 3116 msiexec.exe 109 PID 5080 wrote to memory of 3076 5080 MsiExec.exe 110 PID 5080 wrote to memory of 3076 5080 MsiExec.exe 110 PID 5080 wrote to memory of 3076 5080 MsiExec.exe 110 PID 3116 wrote to memory of 4640 3116 msiexec.exe 111 PID 3116 wrote to memory of 4640 3116 msiexec.exe 111 PID 5080 wrote to memory of 644 5080 MsiExec.exe 112 PID 5080 wrote to memory of 644 5080 MsiExec.exe 112 PID 5080 wrote to memory of 644 5080 MsiExec.exe 112 PID 5080 wrote to memory of 2360 5080 MsiExec.exe 114 PID 5080 wrote to memory of 2360 5080 MsiExec.exe 114 PID 5080 wrote to memory of 2360 5080 MsiExec.exe 114 PID 2360 wrote to memory of 2524 2360 vna_utils.exe 116 PID 2360 wrote to memory of 2524 2360 vna_utils.exe 116 PID 1912 wrote to memory of 4988 1912 svchost.exe 117 PID 1912 wrote to memory of 4988 1912 svchost.exe 117 PID 1912 wrote to memory of 1916 1912 svchost.exe 119 PID 1912 wrote to memory of 1916 1912 svchost.exe 119 PID 5080 wrote to memory of 4464 5080 MsiExec.exe 121 PID 5080 wrote to memory of 4464 5080 MsiExec.exe 121 PID 5080 wrote to memory of 4464 5080 MsiExec.exe 121 PID 5080 wrote to memory of 2128 5080 MsiExec.exe 123 PID 5080 wrote to memory of 2128 5080 MsiExec.exe 123 PID 5080 wrote to memory of 2128 5080 MsiExec.exe 123 PID 2128 wrote to memory of 2820 2128 vna_utils.exe 125 PID 2128 wrote to memory of 2820 2128 vna_utils.exe 125 PID 5080 wrote to memory of 792 5080 MsiExec.exe 126 PID 5080 wrote to memory of 792 5080 MsiExec.exe 126 PID 5080 wrote to memory of 792 5080 MsiExec.exe 126 PID 5080 wrote to memory of 3172 5080 MsiExec.exe 127 PID 5080 wrote to memory of 3172 5080 MsiExec.exe 127 PID 5080 wrote to memory of 3172 5080 MsiExec.exe 127 PID 5080 wrote to memory of 4664 5080 MsiExec.exe 129 PID 5080 wrote to memory of 4664 5080 MsiExec.exe 129 PID 5080 wrote to memory of 4664 5080 MsiExec.exe 129 PID 3116 wrote to memory of 1724 3116 msiexec.exe 130 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\ListBox_Support_CLSID = "1" TESvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\IgnoreFrameApprovalCheck = "1" TESvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\DisableAddonLoadTimePerformanceNotifications = "1" TESvc.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\EPS_2024-02-07T09_33_38.108_V87.52.2005.exe"C:\Users\Admin\AppData\Local\Temp\EPS_2024-02-07T09_33_38.108_V87.52.2005.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\MSISelector.exe"C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\MSISelector.exe" msiexec.exe /i EPS.msi /qb RECONF=1 ARPNOREPAIR=1 USERINSTALLMODE=200977 ISATM=1 AM_ENGINE=KAV REINSTALLMODE=vomus2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i EPS.msi /qb RECONF=1 ARPNOREPAIR=1 USERINSTALLMODE=200977 ISATM=1 AM_ENGINE=KAV REINSTALLMODE=vomus3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3560
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Sets file execution options in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D23CA778F8F1859C66CD8B484FD3E0642⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cpmsi_tool.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cpmsi_tool.exe" "C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\EPS.msi" copyout config.dat "C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cpmsi_tool.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cpmsi_tool.exe" "C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\EPS.msi" copyout userc.c "C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\InstHelper.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\InstHelper.exe" {b8f2cd39-7af4-4f1b-afd7-00b69e15c098} notrayicon3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\epklib_tester.exeC:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\epklib_tester.exe3⤵
- Executes dropped EXE
PID:4568
-
-
-
C:\Windows\Installer\MSI6BEA.tmp"C:\Windows\Installer\MSI6BEA.tmp" InstallationStarted "InstallVersion=87.52.2005;EpsVersion=;InstallMask=200977;BladesMask=0;Upgradeability=Enabled;IsRebootRequired=;InstallAttempt=1;PreInstallReboot=;" "C:\Users\Admin\AppData\Local\Temp\MSI8b9a6.LOG.ts.txt"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D169F6C1E4CB62C20381E1B7EF1AAD67 E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\UINotify.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\UINotify.exe" finish3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_utils.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vna_utils.exe" -d -ap vna dev exist cp_apvna3⤵
- Executes dropped EXE
PID:644
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_utils.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vna_utils.exe" -d -ap vna dev install "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vnaap.inf" cp_apvna3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_install64.exevna_install64.exe install "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vnaap.inf" cp_apvna4⤵
- Drops file in System32 directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2524
-
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_utils.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vna_utils.exe" -d -ap vna drv unload3⤵
- Executes dropped EXE
PID:4464
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_utils.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\\vna_utils.exe" -d -ap vna drv load3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vna_install64.exevna_install64.exe changestate cp_apvna 24⤵
- Executes dropped EXE
PID:2820
-
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\ScvPlugins.reg"3⤵
- Runs .reg file with regedit
PID:792
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\ScvProxy.reg"3⤵
- Runs .reg file with regedit
PID:3172
-
-
C:\Windows\SysWOW64\cmd.execmd /c "del /F /Q "C:\Windows\Temp\PiReg.exe""3⤵PID:4664
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\SysWOW64\sc.exe" create ISWKL binpath= "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\ISWKL.sys" type= kernel start= auto3⤵
- Launches sc.exe
PID:404
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cpregsvr.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cpregsvr.exe" -d CPLogRepository.dll3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\7za.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\7za.exe" x -y -aoa -o"C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\" "C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\DefaultPolicies.exe"3⤵
- Executes dropped EXE
PID:2204
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cppsm_tool.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cppsm_tool.exe" /e "C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default"3⤵
- Executes dropped EXE
PID:2112
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cppsm_tool.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cppsm_tool.exe" /e "C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:992
-
-
C:\Windows\SysWOW64\ZoneLabs\vsdrInst.exeC:\Windows\SysWOW64\ZoneLabs\vsdrInst.exe -i C:\Windows\SysWOW64\ZoneLabs\vsdatant.inf3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\7za.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\7za.exe" x -y -aoa -o"C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML" "C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\html.7z"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4932
-
-
-
C:\Windows\Installer\MSI8E0A.tmp"C:\Windows\Installer\MSI8E0A.tmp" C:\Users\Admin\AppData\Local\Temp\\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\logo.ico2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5112
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C16933BE922318B47F8651CA629F299B E Global\MSI00002⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Loads dropped DLL
PID:4640
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\IntelTDT\install_tdt_driver.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\IntelTDT\install_tdt_driver.exe" -i -v2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\UINotify.exe"C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\UINotify.exe" finish2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Windows\Installer\MSI75D5.tmp"C:\Windows\Installer\MSI75D5.tmp"2⤵
- Executes dropped EXE
PID:3452
-
-
C:\Windows\Installer\MSI580B.tmp"C:\Windows\Installer\MSI580B.tmp" InstallationFinished "InstallVersion=87.52.2005;EpsVersion=;InstallMask=200977;BladesMask=0;Upgradeability=Enabled;IsRebootRequired=;InstallAttempt=1;PreInstallReboot=;MaxBootTime=97000;MinBootTime=0;AvgBootTime=48500;BootCount=2;" "C:\Users\Admin\AppData\Local\Temp\MSI8b9a6.LOG.ts.txt"2⤵
- Executes dropped EXE
PID:2228
-
-
C:\Windows\Installer\MSI581C.tmp"C:\Windows\Installer\MSI581C.tmp"2⤵
- Executes dropped EXE
PID:632
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files (x86)\checkpoint\endpoint security\endpoint connect\vnaap.inf" "9" "4b8ec8843" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\checkpoint\endpoint security\endpoint connect"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:daca4e3358f55059:VNA_Apollo.ndi:2.1.3.0:cp_apvna," "4b8ec8843" "0000000000000158"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1916
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Windows\SysWOW64\ZoneLabs\vsdatant.inf" "9" "493f6c84b" "0000000000000178" "WinSta0\Default" "0000000000000144" "208" "C:\Windows\SysWOW64\ZoneLabs"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1284
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Watchdog\EPWD.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Watchdog\EPWD.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cpda.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cpda.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2416 -
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cp_InstPrep.exeIntegrityCheck USERINSTALLMODE=200977 OS=64 MSIPath="C:\Windows\Installer\e592179.msi"2⤵
- Executes dropped EXE
PID:4820 -
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\epwirfix.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\epwirfix.exe"3⤵
- Executes dropped EXE
PID:2628
-
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cp_InstPrep.exeUSERINSTALLMODE=201081 OS=64 MSIPath="C:\ProgramData\CheckPoint\Endpoint Security\Installer\EPS.msi"2⤵
- Drops file in Windows directory
- Executes dropped EXE
PID:3320
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\IDAFServerHostService.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\IDAFServerHostService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2604
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Compliance\Compliance.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Compliance\Compliance.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3660
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\TracSrvWrapper.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\TracSrvWrapper.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1120 -
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\DAAW.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\DAAW.exe" getProxyAtt2⤵
- Executes dropped EXE
PID:4648
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\DAAW.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\DAAW.exe" getProxyAtt2⤵
- Executes dropped EXE
PID:964
-
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\cptrayLogic.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\cptrayLogic.exe"1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2868
-
C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\TESvc.exe"C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\TESvc.exe" -s1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- System policy modification
PID:4136
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59216f.rbs
- Size 29KB
- SHA256 fe8ff25b9a0436a91cdcb89ba6938f11c5e468d8b4c0455175da6eada8a8d2e6
- MD5 c518a64d0b00c5ffe624a643b2bed317
- SHA1 9169f4b340fa132ce5ccf3bcea5a12256b40b0bf
- SHA512 227107329e6c2d82fb461ee329b8b66911da083291a64fce6677ce6f5142e6c8e76ff05f4103c3fd9a6c75ed50566fd9019b20c1c69fe57fae7fb0560a6a1672
- SSDEEP 192:rGi+J4XQek+3GPZk4cleHyPRIfPR/em0Rxpyu:rPk+3GP2zPkPHG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e592174.rbs
- Size 22KB
- SHA256 b9637bf316a3b07d7994cd6ef14fb2d614a777e000268d86de733d00baf45bc5
- MD5 2e09e6a11c369751573b3aefc345c083
- SHA1 a1468ee2816515977f4685f7105cc640ebf5b877
- SHA512 eb3df9de5c18db4a591aced0c53658a8163b39082fe33868072c3eea48b4a9d0409d7c079d230fb278453f661606c4d939c1f2bf44d5de4a9e7f2b9e2a7dce71
- SSDEEP 384:RDcn5JUhhGkPg2vdg2W41fq8dn134txPHPdfnm:RDcn5JUhhGkPg2vdg2W41fq8dn134txI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e592176.rbs
- Size 389KB
- SHA256 5a50653a38960d7bf95be09390caa6fefe6a8fdd768f4173a948a4f4734a2ccb
- MD5 df7ea16c3105dd3a111c495603e8101c
- SHA1 8b6f91a5e9bccc81c82689f481be4135c48b054c
- SHA512 67372787fb50e426214aa8331e254756fdda83879d42c80865a75432e54f9d7713f6f767e7b43567714ed3859d473bbaba032d24acfaf559f76719559f9809b4
- SSDEEP 6144:SPBlGpF7pNYpCzWmVd0tO3loFV0fzhT8B5bYFoalURm8Kogyw0kl+D:sopFN+QzlVWQ3lI0ftTk5+zt8Kv3Pl6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e592178.rbs
- Size 128KB
- SHA256 33beb0337970fdfb6814eb708ae51b205a588413feca53e9f7dbee2b29e1c24b
- MD5 20ab91c1b325c5f6f1ec38f891049572
- SHA1 9c42963285dbe40089a453640aaf7bcecd9e23e8
- SHA512 9408be9bde11c61cf79b74fd658f404f9261a4d07f71dc3bc365179558a141a2d3f5a519ed515df4a602ac61a980bc3a8c8f605f48cd95caa2ede175b84718af
- SSDEEP 3072:p88yBlGHJFRgGeJwuDzuPxpNYowONGIWUlv5nBNILs0j:ePBlGpF7pNYpCzWmVd0j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\Microsoft.Diagnostics.Tracing.TraceEvent.dll
- Size 2.7MB
- SHA256 e85775cadcb9d4e898548c8f3d6af0af12faa6d6d8eef555a5ebedf9df9448c5
- MD5 19dc5789af2d424843fb2a6ad5a51981
- SHA1 5d8e69adeadb0fb3ebfc81f19d016a9a2e2b0c8d
- SHA512 bde23f0487dad07f201522d3b71b02ddc13798aad915c2b767375e2dca71f6806cd76c83b4f03aaf5360c97c89d6ba4a446309ae5918f9de72f34d125b1f6135
- SSDEEP 24576:IKKVJL9GnYSHzkuW2W/oqG6UtDCuUhUE0ACFZsTArMMcytOOr6B+J:UVVSHILwdIt2GErtcy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\ReportTemplates\abort\css\main_nav.css
- Size 1KB
- SHA256 5431aeab765b1e257c4cc07b24bdc453948b99e895b1c54d7c3d4a74ffb7bd93
- MD5 f00af700aa23586abeb40f326a88aef4
- SHA1 ca6a601dd5c39f3924956ac9e0bcfd8864de253a
- SHA512 0dc2c7ba0949a3b3a081bf97a043c625b82cb72f8cb2d830dff9a3553b0684449c147fe2804e9117e4687dc9c568c5c1a136b925dfd4170b2dd5d93d1a83e21a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\ReportTemplates\abort\images\menu\cp_logo.svg
- Size 7KB
- SHA256 fa011aff36410a8889589a215a1a389a8e8f375653d9352f780a62c63054b57c
- MD5 5d0f78b1098043637ea67e65ac025680
- SHA1 89b9f98beb20f9d2ae9ebb2ed584ee7e707a8d67
- SHA512 2aa3f6af1e9d7dd5a832af1fb1358d85818c328bf6378626b92333d14d477536de6db2efdfd7158309964662fa3b48f065b0188cf69d770242258dc2742b4b7a
- SSDEEP 192:JKTnvdL3wOtuTVDCJ3tAMPiPikdPLchrOgPqTTbjS8gHnWFD:QTnV7UVDCJ3tJiPik9LYrOVTxYWFD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\ReportTemplates\abort\images\menu\sba_logo.svg
- Size 151KB
- SHA256 72b759cd8fe60d03467ce9e600d2fd0d9fb9f1a7402740e7a7cdfe4b9fc8aa4b
- MD5 388863ad4ff482c3fe215fcf936c19ca
- SHA1 3288c61d177c15463e64e496998c1f75ef7a4504
- SHA512 968a1c2126b169f55e5d326fa50907a16b9a1aaa57a066d7dd55de157772abf4b140738b1e7d475d87f4180d88250a4bf5196e9562b5a8368730f75745f63c43
- SSDEEP 3072:T6vPKKeUwPYAU7/qM1bR32K5wyOXptdr00AkL4axY0B7t2:zKe87HneB3dr2+skA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\StorageMonitor.dll
- Size 480KB
- SHA256 d76219fed1c04fc84ba87c394a3aae3b4b64488f105977c995c684c6f74c4644
- MD5 bef305e99d0bec3efca135652091bfd2
- SHA1 850f6060947527f67e7982638215f952931ca448
- SHA512 4034de60cba2e01882f081a1ba6bbf4e8fc3f07825355cbe714344b5cdcbda31cbb97f91ef2b4a3452483ac64010246189be09d584c3c1220662137f29317149
- SSDEEP 6144:ZHNJ4t0PSpB25nQshCB+D8AbVA3nMNbBe74MbohmxWGxcHlgwe3v0KhR:ZH/bS+hQvB+D8Ap6noQ9boHCBF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\StorageMonitor.dll
- Size 385KB
- SHA256 a9eb05fef82456a75f2df9bf24b1314010984724764b8599af0dcd04eabeba0b
- MD5 87c759287c0eb689bde753ec57142263
- SHA1 580fa8e9c0e0f89e3e95ef6950197664f86a2db0
- SHA512 ce3507d39c47b8ec7de9ee7bcb631f5aa066dab67e7486a17bb93b7cf1ac488ddcc1c95ea771d4af33b702d268fa49cba0299e0da2d01b17bd8da88d8e0948f8
- SSDEEP 6144:I6F/5eGHqq57SAyIYLItxO/xNhQypqbcCmXHGlAO/+inxZi+Wzh:lF/7qq57SbIFMhQy/XHI0giN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\System.Runtime.InteropServices.RuntimeInformation.dll
- Size 32KB
- SHA256 2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237
- MD5 82deb78891f430007e871a35ce28fac4
- SHA1 4e490d7ec139a6cde53e3932d3122a48aa379904
- SHA512 e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a
- SSDEEP 768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\cp_InstPrep.exe
- Size 4.1MB
- SHA256 9bbccbff7b4cf6b4e25cbe64a53a006940779a1c5c1b067e0ec9d4e64a59ea00
- MD5 a6a21c5eaea8ed09f8d60078e9cd3ebf
- SHA1 747e6e3aa9c766d39c5e9afe793e90b91dbae753
- SHA512 fbef5ef71dc1afd2365cc6922fbb08a12255e1161d3426a9ca64a391d156cdcc30d83f7f575a5d3ee8cad512d9c7c361df8d91042552db8e19bb3f019f83ad62
- SSDEEP 98304:o6S+VDtFHBeNkMEBYi9/JM9ysgxb3M7soxdG6C+y/:HxVTdgvgxNVr+y/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\DAAW.exe
- Size 298KB
- SHA256 d08b80fe601b3d1c0ce65370f50fdb84c32f72def5012e7bdf455d0ddbd4231b
- MD5 1a3383eca669a4be2de14b9a3eeb137d
- SHA1 29707a6cdddf62184deb0fb941847c2b80e6d661
- SHA512 76b6bafd9210f8f11a88822d38f040fa89a4e9b6f4971011ec80276c85757c2be8696e1ec8284aebdb1f422a88f7f4efa64d5c551963e8107c97ad9944217c5a
- SSDEEP 6144:UaZlmMOyO/8DCpathfJH4IF3B+hXt5PBJZr/TJ3zZhhoWdg5D/X8qV9pKIb:UaZlmMOyO/8DCpadH4IF3B+hXt5PBJZ2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\res\ConnLogo.png
- Size 15KB
- SHA256 e15967c7d5e42feed5c66dee1cedf5ba1635e13f4ab32ac7924b1ea5ee5910be
- MD5 54a672a163e27e5d3668feaf138fb6ea
- SHA1 c9a5074d72dee5173badf4ae3f0d417395c4c0a0
- SHA512 dab02eb280d80acbaf057dcdd8963b1ba4c367aa482882d071718ba1b4cf9a51756ade37b73adbfb9d0ac5360bcc0d2385b66c0d6709ccf24698d1ebf0a1c990
- SSDEEP 384:60Sinm2GOulyO/WAYpDUR/wBGuMIe8I5RQZaPJ1VJWYlP4:VjmnyrvpDUR/wBZMF8I5RQ4nO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\trac.config
- Size 1KB
- SHA256 722367615b038aef8d1ed2efe942aecd818b7efa217d615a3f2da71f84398cf5
- MD5 3264e078501790b964ed0bc5cf79630d
- SHA1 5453bdc5b5a36a3438a8f6d5595d3a3297046964
- SHA512 eb95d30edb1583344e47b5396094a135425233bd12e24f6f4866078c0b18706d5f1bef468d55fe624237f7eb6b34a9f91e0316c678e6a5602fdd6de0d753d01d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Connect\vnaap.inf
- Size 4KB
- SHA256 679939d1e3c1e51d32a86c5ce348c58ba3448295b92238e350aee27b45de5c37
- MD5 573345d5fe94093c254fdf95488b66c7
- SHA1 638cf92b4d471885e1db95a6bcce402adb91c181
- SHA512 bb66dd26379c9ab76bddf1550f94aca1c429cf4e680a65fe548050b3f5b5b0fc3c876bac8be46c79a4c9baccdfa65e3767c4a5e5f427f429826b9b155a84553e
- SSDEEP 48:HkobruhUjdh5sZlexkrrx64NbKkSCNX51vuhFlSh/82HXNptDWNDMV2zLuwuL0Ci:HF/aUp6x6EvoUh/Cm5qDfDIM8uUhGH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Reputation\Newtonsoft.Json.dll
- Size 683KB
- SHA256 9000cfcb27d21ff1d9f7196b678ecc93be98af2a14254c03a554318891e6cb23
- MD5 418bef061b4d667cb32c091e0ed694c4
- SHA1 61bded55b2a15a1854db23ea93b3242f867aa5e4
- SHA512 434c29a56702b385d71a31ead08c33b75cf2dc70e88d7b7f3bb6d628fe17ceb6a9d052095afd28c7e4a4e83dc82489634ffedfc7dee3f3751593c602d70fc6f1
- SSDEEP 12288:Af9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:+XNL2PVh6B+Bzjmc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\_locales\es\messages.json
- Size 13KB
- SHA256 861eb5d89f9b7d9ff23a772fd54837ac8d94c60c8a6e904ed31646028ea72b49
- MD5 59fea6762e9d4fd52180e9f4bb6c1969
- SHA1 0e639eca492f38094a7aba9804df901cc5c4ef52
- SHA512 c6452a6050fce8837c15eb3bc3203afdd50e30057223e94a0f01417d01aef8b45bf211f33ef444bc31a44abde50f6013ff60d4a1cac4a4d0c0441d3afdb59714
- SSDEEP 384:DrRY0J0064XMj23CghJtoTozwmQLIjvQS:DN9Jh64XMj8zJHxQLIjIS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\_locales\pt\messages.json
- Size 13KB
- SHA256 7336a0b6d3f9730979e3ff85126c5bef7fc3b1eaebdd9abdfbd7d08a6d22d773
- MD5 073a4221e89fa2ae7e37faadee8394b9
- SHA1 eb5c6bf92af3d67f3dd7bf0b8fb4e7f6fa92f2a5
- SHA512 f1d72442a76681c513f2da490e53de959057a91dbe5c34183a5af7ee66449886e808630406aed51745be9c15e6688ae7d2a1f431ebda3c3721dcac9ca0ab25ac
- SSDEEP 192:BbRqOxVSmrzrbhhExxzTMPh1INm8VSSjsvo6UX9e/mjNY7X9Xm1ec+Y7i4yKRC7x:FRjFIZ1Ek12Yc6PgUnnSqeva+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\BlockSite.js
- Size 29KB
- SHA256 05fe8cf6f975f39ac5e68b4d3eee00884cd81071a61726f83bc6672cb938078a
- MD5 4f5d8e354614bc609d3d4515fa79243b
- SHA1 7c30746ed0aa3f09d124e583e88d7d23d2134147
- SHA512 ab062567d9f1f4cd661d0af071bbf0ee80c44d243472bbaaad3df9e7fd6b23e692b14f29b7186c9e6349579f9b894e4d3bd2b787cea1178c182193ab6c504b7b
- SSDEEP 384:PmUlRzJ8QvRwJGGk9iXcZJHAg8oL6+P02uKQVa0Udao8MxtahWTy/6/JcD83B+Xj:HfSJbMrHAg8F+PwKQQdaoLm1gkSK9qC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\data\icons\CheckPointLogoNormal.ico
- Size 9KB
- SHA256 3bcc54b9e05fabeb877901ec6fa36490360807aa0037a0a36a5626d4902edd0b
- MD5 a7023fb9f43654ac865649c8e3e4e657
- SHA1 7133f72464534533245e94967e01801f4a752f2c
- SHA512 7bf62f1190515746d34a6110538e61017f82177765fdf469e2649f7d02aba12acf1424d5dbadd81bdd254bf3d1f39c8c06e78929c1344c0628a154ec1083a698
- SSDEEP 192:sCNhCNF+4FfRY7qEEtOyavXQp7ueoT1DCO1ih2Rm7wNwSM:sCNhCNF+cfcDEdK6ueO1DCO1Tm7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\manifest.json
- Size 3KB
- SHA256 cd20781aa902ff8bc320809ac2cddaa799016380c0f3fbfd47893fa28728748f
- MD5 04b08b5c2980976eff21fa206b64398b
- SHA1 4dec5d651c2a5dac788e67e75fcc6d6867ab6297
- SHA512 b5637614945ffb37ddebc278516410da897b56a623bd61d4ed8be026150b39c19cf30b4b100dfadb4bfb2f30e2e727f3d09d07c7a1808c017523d03e2671e8c5
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\SandBlast\manifest.json
- Size 2KB
- SHA256 08f785f988c9265f62a8ebcf5f6c6371c29cd2da086d03c4f963664c584cc75d
- MD5 b6c8eee84e48bfb335b18c38bfffb75a
- SHA1 7e07a78a196da2d3d4aa3ceb6b25eebc5c821739
- SHA512 dbcbfe5b0f41173eb859d0a590b45b16ad9c5c29d795b85adda8547d653d5d01256694ee9ebd1ffe33e617514d0c85f673745eefb9d5c716ff7746099db444fe
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\40c071c9-3758-418c-899e-423d49e41f9b\blender_light_model.out
- Size 1.4MB
- SHA256 dc8485ddf01b6dfafe72cf941a5ab5370215ae2bd7051462fa87894b8a7be774
- MD5 1fdd8a16890f97b1eb182da32fb22868
- SHA1 9dd1d941fb5aceacfd63c58e13801e299a30b258
- SHA512 e95fba30346434c6e7ea868a7046ebf6d0abdfb79a832c1eaad0732781c9b3eec00c71117100ea6e71411f06f448c580f0f2ff6a155f27c7ae7a0bf154ff28ce
- SSDEEP 6144:n7V7oi1r4hACW1b7nh9OHjKrRUotprOlmJEDb:nOiMACW1b7nh9OmrBtVOlmJgb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\58a2ae19-6015-43a9-a8f4-f0910390f2fb\blender_light_model.out
- Size 2.7MB
- SHA256 7ca6f1ae04a1f934e9e58a20a29bd9e12cee47438df0774297bc15128e26ba36
- MD5 c90171d3c588c48f2e8657bfd18e0f57
- SHA1 b43a3fe5176a8d568b59e1907e44311a0b9475dd
- SHA512 4eac645fcf71cfa362b89c253f6cb7bf482f95044d59a3f7e15e1d5a7b57a0e7dc510d18a6d354fc5be90dfe34c16a3d982312180eaff35e63001768aac86326
- SSDEEP 6144:PDCFK7lQrqDhHh5o2JU8E7kYO6HD7vHH6:PDC8lhHM2JGkYDv6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\Assemblies\SA\85ccbef0-27a7-4ba0-bed0-4117317fa4f8\officer_model.out
- Size 6.7MB
- SHA256 91d273f18b2931d3cb8ccd6c0deefceb1de622b5c5f50e7a1787c016443117a9
- MD5 2230a35a646ded1ae7793b3dc86ee9b3
- SHA1 0e3a8ed0793e373155d24f2fc0152e2862b8aa18
- SHA512 5f427047bfaeac31ec1e78523248e2ce2d147b1a2cc0aaf24ef19b30933946613fb4226c5eca582c0869c0e2b22f35c32d8c3050d7b4c420f25da1237a5d3cc7
- SSDEEP 12288:xkQYbDM/PqqLlaGJFounLXEByAw9wJbFwsLgsrf/pYhBsWWaFkBV+Zox+K3:4hv7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\AssemblyResolver.dll
- Size 18KB
- SHA256 8bac1df51c80817fd8b88a0aa815ed341b1643a3a418c78ed721b23d618c8af3
- MD5 007f8f5b69b3e56673065f50952f7931
- SHA1 67d9870e4d92565682e5da78507b982eceb43fe7
- SHA512 96a91cb5b552bfe0a8554d2538b6878ce12b3a6052c0edc6cc062fc93df4385044163dd44a933b7c96dc56c2fe30207c282d98379f7e90d5c986d38754474382
- SSDEEP 384:O/sZv6FZqGJfl+R/ocMza5ZL586wGBkNl6bCI9IYi8+G:OJFaR/ocMqZL58ykNlT5Yio
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\CommonDLLs\WPFLocalizeExtension.dll
- Size 34KB
- SHA256 28942fc14ba2a3f15ee91afb751d576f61283c6b76e6276df074ce5b97610d2e
- MD5 916c3fbea62cc47236110833feb5a240
- SHA1 df6b526d92d63e316f400f700a37daf8887977d7
- SHA512 c6686c53061ee8297fba0dc6dd01bdecda496dc8f8b86fc5ba387e627a9e1964c61aec5678e3b0f82d4fef27daffc55a4022b1283dc52d575ff6f926d48b552f
- SSDEEP 384:GIHjq8pjzck4Q8ZU3kE8BhzE+UwTHcK0lu3jxYo8Tft3sVkC6sMQHKUeJ8klVmkI:jjzck4QG/BxE3wG+COVkoSVfDzS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\EP_UIConfigUI.xml
- Size 3KB
- SHA256 e8cfe2a1c467ddaa37699581fbe03f91ccc1e429a2acee8506194fff34f7ed61
- MD5 fdbd657c10c42b0f702b4639940f3171
- SHA1 ca7e66b3aa2569d8c95ee203fc8b9c142fff6c3c
- SHA512 f36c9b17d02a10cf18c42fc847c7b4696f45432e829eea3cc7bf532b7de9d50b637d3671048de317cbf3d412345d56c14e5e9704b07a067fffa856519b8516c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\MainIcon.png
- Size 2KB
- SHA256 d981f6eaf6a305dd033466968d41a700d50e3616f5195abfa795f18582dd1ad2
- MD5 ae9ede1193e7f3c3a47168cf9b3330f8
- SHA1 e5869dd09698ba9192b9f898ec344235b656005c
- SHA512 e209e8d1196b5cee728921226a9b447ffd2aec9182de67966f34f7d5493d7dfc10a0e036b10969a85b9296ba9e7847b03a0007e3430afb1089b782d5b6d471a4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\TopicIcon\malware.png
- Size 3KB
- SHA256 0ec85f0cffc879f0b2cbfa480b00973bda5f64817fe1da4ec1a260f0519d3261
- MD5 9808f1b8d6a162fc6d937f1d1174e1a6
- SHA1 c009dc7ba2d05214ef98affb73ddb523063aa78c
- SHA512 f6a3cc0385b821d59d96fd42f2241d651743266bc094c0cf194d3b5e3ebb8391573d98a273b2576242ac8e9049451fc705c6b084235a8c6815bf2f87a2506cd9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\action\block.ico
- Size 318B
- SHA256 7cd847800b5e0a251deb62aad91f8bdbece6b36dc770f638841ff4e42b44b7b7
- MD5 a701505ba665e92e1400980d37ec68ac
- SHA1 1afc5271c9196a559add4d61a11b94f52097ce4e
- SHA512 eea42218b0447b2a13bd28463c905745c19b7994ac320958fc93eec862a79c0eb7d116d489a5ccd4947c681c54fba64f731976e7c3c0863155229f29c5eca2a8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\action\undef.ico
- Size 1KB
- SHA256 7ff3c5649924d23c1fa52f9fc57ae4fb3c0001709dea71bd5b15767bc3759b62
- MD5 4882dc765067b2820c4da0543bcc651f
- SHA1 10ffff18b53ffcb048d41358fd6253cfc0d74678
- SHA512 86bd90ce22e95724c9d83b36f3fa08b4d5c1b2026c914989b52648cd7ea2247cba868b929dd50e7c8179b65f530243c643c46b3b9a1d40756f7624eaeb3fbcb4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\blades\firewall.png
- Size 2KB
- SHA256 d3e843c87653ed67c04dd28c14119c19708be72eabad911924a1dc9abfe1012d
- MD5 cc79dd78f2225e219055123ab290e3d5
- SHA1 78c7c7c1f432c4b8720e578556ba02328440bbe4
- SHA512 f3ea4b467d0b21a36032dd8977a623f92ba65b82fb7551cf6dc63f7a9b27a431a8e51ebdedf9bb23cac69fa1d40172420946fc7f671b15a16f4898013f2dd52d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\blades\me.png
- Size 3KB
- SHA256 19c4ee1aa89acb4cf59f6d6811aba8521e2b244b31714ffa7b5843f3c4c3a979
- MD5 f4b871c9dc91f696d7f9bb87e9c16c1a
- SHA1 f59a54a43fe7143d2ec598dd8ef96e550445679a
- SHA512 3e48b613d2a2cd0ae71b5d7c20a916e5abdd820535df7ff4bc108da4ee6def1060d33448f1f50fb8c342fc9f88109a4a95f4184d12d98520dc97c39c0662243d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\risk\risk_critical.ico
- Size 1KB
- SHA256 088b7a47ace708365931712857f90469444c9875b3bb03a090de1566056a67c0
- MD5 6bd9464bff8fca1f8eed70247d232328
- SHA1 a713c9ad120771f9e888f42d5c03ad475274d06b
- SHA512 81118b5827951aebf02231bce3ab07b03eeacc23cc4a787108fafc91edf4699cc2f1dc1407c3ad37f1639bdb59f86847cb95f3a7e02842950a515268dee24769
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\risk\risk_high.ico
- Size 1KB
- SHA256 0eeb36b3d8cdc118f98f69a8a4c570e7d3b61b9c992516145dd8e873c3737f9a
- MD5 3728dac68e466e39bcf7ae91c2c9562b
- SHA1 a1ad69a790ed32b8c78c80a95b219ff561e5da4d
- SHA512 7cefb48cbb2f259b5e6542586ba6056e3a11f5fb4be06077b136e8aa4261c9e95a365b120a417131acbaf2b731280cd6fe4a4c33e23afbd99ccf86682ce6a7ee
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\risk\risk_low.ico
- Size 1KB
- SHA256 f86ccee4c75c1f267e8d7c4ba9ea8a77ed8ede000b9fc13ce490715c989fa036
- MD5 3872c92ef6a74ebe30dc56169e38c60a
- SHA1 b381ee125b17f288c38ef237ea6972db99b2008d
- SHA512 5340ddbf920006aca25f5a48687f2191c103ace3a62f991ac1a76da9ceefab12f45ac8af7da9d9ffde84205a466fd59fd57aa5397fc19a883553b11da85b0379
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\risk\risk_medium.ico
- Size 1KB
- SHA256 605bacc80e819a1e25e95a7afbb704424ebdbbd73c519c52f43e1156f959eec0
- MD5 a4fe6662283dfe23779e4a7d9ec4b683
- SHA1 ca4d34586dbe52eb8673b9dce3e4ad04d2eba2cd
- SHA512 04d720eed87e6979c56f4ed38eee37b078d05ccd79d240fbe7bc95ff153d9a680149630a5571b8e3b4fc7709066f468f6ca03f3a24140a6b0019af5b889dfcac
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\Report\skins\default\images\widgets\icons\risk\risk_na.ico
- Size 1KB
- SHA256 aabbad3bd6f85004d0794adf23b2445e3cbbf2438caac2d2083667d31238a49c
- MD5 f2ee20f99773b8a2dd0e89f5f9ca8534
- SHA1 e18c3785e08643feb49c491319fc6d08b268ea79
- SHA512 dda173d63c1fab91fd401d3c1fc8e26e7510fd140aca787a2bef0651c1288341e03d6818fee4801f52cdd466933a30e283b61be678b1c7092fbad6aa5b7a1676
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\mac\UG\Content\Front-Matter\transparent.gif
- Size 832B
- SHA256 1d600a0343eef0b105f4dd86d1b7572306777214a30e5b8d49e91c153d7bca31
- MD5 50085591b69ee0da3fa16386d95d0f9d
- SHA1 ceda0c5cd17b799ac84e1bdc14d93d1b0114aa45
- SHA512 1e2750b63c6ac5a7cfe07b854af93fb46bf80dcc116d4adbec93d10bd934e803d5efd200d6b340b51273d78e324727944f7015d94e0131d07b5f9a0239d6ae45
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Drop-Down\Drop_Down_Large_Arrow_Closed.png
- Size 381B
- SHA256 e53bdacaf03d9bf176921ffb263d932c4d914353346eef7839c65f4f41b843c1
- MD5 fbc7892ef4c741120df0958d41b61b3d
- SHA1 410066ee2bf2eb33138397a04f9636d3e7475d50
- SHA512 51012e639c8d8f90d76cf618a9f5f539566269e7f20f713a4d30acf30f3649a602d468a35f6ad67bb7dd4fa7b70c8e8b30c20b8afe7e508bd77815ca6cef94cb
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Content\Resources\Images\Drop-Down\Drop_Down_Large_Arrow_Open.png
- Size 376B
- SHA256 53c480c42f3ca16a6b62d772d87fc93c302e41949c5c48d2479f16427e17371b
- MD5 7c5a1237f5e39bd9dc09b1ef2fd7f6af
- SHA1 045ded51b4ba9c1b193cf32ac7ca7cf7f58e2da4
- SHA512 1be2e3d4f52f12b85e159084c6daf58e779fa66ccc1c16d5a9318c6cad7118d2ca00ce5dc3ce9051a76d3c3613f71d4a5f97b61ad258a51edda6952f8d4eb295
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Data\Concepts.js
- Size 11B
- SHA256 0089aa050b89192e6bb4f33c9ca831d4215f30a24cff294ed17a1a187131e267
- MD5 9b623b63a22644fd1a4bf2b3af3481d3
- SHA1 4225b4af3114cdd6294dbd908c07fb09cfa5d3a7
- SHA512 6d78f20056ae40c637238da48482c4669c3942ccda1af8cb989be6f84830188fa04bec9925d6392ac50984adae583b0ef026cbe60443959f7df614a81d278c60
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Skins\Default\Stylesheets\Images\Filter.png
- Size 313B
- SHA256 af1b4bc383f4ca155aae731b0e2e51241ed6b1ede2405a590d94bd632ce0fb65
- MD5 b9b5c7e33a20d7938673a12898164901
- SHA1 72b8e2bf017d4193f9ad99f2602fecd718160606
- SHA512 40eaad991f8d3d0c6997672d3efe6a74130f93c976e3e05d0834a125e241df6ce25f0bbc8c5ae83996ea3a504accbfe12d8c0a223ce103ee003e73b6e94b52e7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\docs\help\win\UG\Skins\Default\Stylesheets\Images\FilterOutline.png
- Size 301B
- SHA256 d4284ad8a43ef43e47678ec5da72d32f073079f62015cc8bdf6b9126eeae79b1
- MD5 b8ad5a0b50040722023ed7a59696a536
- SHA1 38108b1da5fd78cec9ddffcdc34dac94e18367b0
- SHA512 fafc112d596d2c452c8d68c973979ae19265aa537a5662700cda2bb5e7b5aa3739401fa6a832baa242865e339e2be32034c25c7dcd4fa838e35eb1c3a1a44f31
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\HTML\images\table_icons\ok.svg
- Size 838B
- SHA256 c61801e7fc352990e98d4afd9266dd808ae2c6d02044897c51a753d68a12a624
- MD5 3b40d49559c45c670dbee2880e54e8a1
- SHA1 d0b07f27a032c803d06df87c0643332de5ba53ed
- SHA512 c6fd114c2c83f0c5caadd75567353d6ff2edf773cf70d259dba62fa75bb018dd1e607f0f868f29cf3dd2e2a7dad54827808ae15658884658406da5cc4aa149fa
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\CheckPoint\Endpoint Security\Watchdog\Epilogue_spdlog.dll
- Size 647KB
- SHA256 11253c77d6f9569c9d03e4a96ef510fd72bc2e86ab4c4094d24104096782e875
- MD5 c61641a9138c88ad1268ef430ed21e96
- SHA1 bcc5edcf2722b1a7d107c18117cc012d230a2c2a
- SHA512 f7b785f9e862016199f9b9a6b2bd4a6e9a6217500f755e177046b82a31beed889b4baeb2bc158bbe2e0295519e402bd43462be3abfbe7aec49fe98bf7ce293c0
- SSDEEP 12288:bhIQDJliiGU2p8GAshey3wK+GSHwbRzQUBGbU4OqX4Fy+R4zK:9IQDJliiGU2p8GAPy3wlDOqX8y+CK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\DBStore\Events\graph\images\procs\damage.svg
- Size 6KB
- SHA256 8293a7ffaacbf813c8222fa5a461d75285b8e1d4270185c4bf3a627aa7ac9c3c
- MD5 de161259823c051adffcdc9322700675
- SHA1 3363e771ed49f9c48f573c18bbfc0ddb92b59a2c
- SHA512 85048747920f6293bd40d6516a26f1086c228a0088922e365d579b3c4bbf17e9eb56390864f9ebd7c524b3c5558bca917f141569ddf5f567d99798ce338e459b
- SSDEEP 48:cxAvf3a64VlmVbjpd7gj3PaMkxvmOTaSgDlI7n1LUC3du4ZzoyT7XSKdlHVk6Y+A:hvfqSoFJ1Ce+O2ZoeUb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\AntiBot\DB\telemetry.db
- Size 96KB
- SHA256 5a860c6904fa392c37ab55425a3412121b6a5ec7d78fed0456a5c0937356071d
- MD5 81f810ef735bde4e8ccbc04682bc4e18
- SHA1 a76dd6d1c1013a03c3a0a2b0dcf47131d1ece55c
- SHA512 d6518545e690b021bb14ae72da4a6add599a1076f60aef26c38aeb0b67e429feda9d0c89fa88523fd3d0f2ef8ff8f786f0fe5b9fd853cb2511921c46fc994376
- SSDEEP 24:D6yKcmzqUNJZ0JjTJcJRJmJzJ70JlJqJvEz1xMLBuZuP/O2IbS:Dgcm/4wzCFO2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\AntiBot\WebFiles\cplogo.png
- Size 5KB
- SHA256 b5772b8329930bc7432be10bd686e2c901a8eb799fd871ef1d36ecd325932d85
- MD5 9abf66c88a11572e99481a7d5fa4e9c4
- SHA1 b211713bc97991aa88509d2aa88be33adde6e4f0
- SHA512 6ac637476d9ea6fb96218f75fd8aec5b8d5980e115b2434b8afca8bd9000862c3cb6e71f7a6b4cebc411af10179331a72eceb4eed58d24289158824bf1034e7c
- SSDEEP 96:l4AQdJIuyWGSKdUxrKA2jSQtwg28RgYbwmAT1Kdk8Gzana5flDjfjf/4fHvQe5cH:l9SLyzSKdorW5Wg28wmI1KiF9BlDfMPc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID130_ID_0e7fd330-6617-4407-907c-4a89c5e357e5_content.cpprof
- Size 37KB
- SHA256 9527d305e49491387760c6456c1fd7bcf0e0aba08c134fc194ae6b095fa8631f
- MD5 28f5a44cbca4ab37179a5084dddc962d
- SHA1 2c97a2e4e2d0d4fd62ffca3f33fd48b05af47350
- SHA512 fb59d52102c48b0ebceadd5623e38c2d6cad008aab433804710bd3da8a48d88e93b10bbeea5c6e22a37130ff643077b2f8fc58e8410cc4eb77178f4aacc614e6
- SSDEEP 768:7G6JmKoGS0mHJZazdm2vxSk3mj9pbJEocabw+oyYOWHrCH77zio:7GymwRm6JvYk3mJfEofjcTHmzio
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID130_ID_0e7fd330-6617-4407-907c-4a89c5e357e5_info.cppol
- Size 341B
- SHA256 1e26248233d7b33c10e70f8b97278b7676c950f49c855bcc27bb0e3385b38bba
- MD5 b1ab54f8e74a1c15029da0d0dcfd3875
- SHA1 da87c864c6d822c373bb44fea4021f584fa771d0
- SHA512 77a432332d2666f2d68a8b5accb055bd2788d2932ba5e4ec967eaaca0be3ea0ed1dac6184a44ba725cf5cd20c3361007e926234031f349c69977421df45000aa
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID130_ID_0e7fd330-6617-4407-907c-4a89c5e357e5_info.cpprof
- Size 501B
- SHA256 c8135f37ee5d7bc81400f8fa69df3bc4be371f45fed26e7b2459305dabebeaa6
- MD5 c34a3e998d1836fcfbbdd60a7e8301e0
- SHA1 3a73e30fbc1fa84a8e4ec79e490c4e003a7d3c35
- SHA512 39570cab2d51639ee3de3c8d94776d32d8e8b81c4f69fed181a5941c95477814e04f99961f54fd3e2086f564d3c25e0f1c7f5dabfb7e87b0fe3a4fe65075414a
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID20_ID_a1103e73-e68e-4d94-a499-a60d058550a9_content.cpprof
- Size 12KB
- SHA256 e3ef08598ec8e8659f49c8aec598f0a11048384056b49f644430dea591eae37f
- MD5 d9669756e7887e8970367809f63f3c62
- SHA1 1746630f3847d72b9693bf35cb129f5f450985c5
- SHA512 cda750bf49bfa797d118d49ad44a36c6f11203e59c8280a4da860c3a9f1306273f5709e2b4fbc9f217c9830f7f0d879f7339ee99e8ea67b9531f470c020e5fb6
- SSDEEP 384:+MBUZwWkMPZRes93XlmGgIlgJzbX/WfkXoirzVhMwI:+xkMxRes9nawghbucTPVhk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID20_ID_a1103e73-e68e-4d94-a499-a60d058550a9_info.cppol
- Size 341B
- SHA256 8c1741240794dfc2a9b52500a4c1ae056e38768c91bcd5dd55be21ee3d622383
- MD5 e197777a488954d0547a372da9930574
- SHA1 84d8ee2aa24567f3b1411d5d282f3f3068d1b838
- SHA512 b87014dfe0765bf6382d8e7ff807567fdccae04bbf392c75e0fec09b5543131d5b8b6cb8d13fdc6f004a57ef847e18dc99a761b182c004cff94c4b83063de427
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID20_ID_a1103e73-e68e-4d94-a499-a60d058550a9_info.cpprof
- Size 501B
- SHA256 cab217db04eea639ebe5c0b1baa1bdf56cd1715d83432dce0591f58c5a511d9a
- MD5 a890a0f7c59165950b5684009577e238
- SHA1 6dc882e1e06d6ca24d33b12141714a487d9ffa69
- SHA512 8bea62de7c0fd195538d8e35ad040f250df7dc450a96a90795ae12f2cc5ef9e2bed5208dafddc717be7f780f6284dad92ee82853574d1a6a1c907cbce51330d3
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID402_ID_8347f6d9-6043-4145-b14e-d8dd54c81ab9_content.cppol
- Size 293B
- SHA256 4a8ff72fe28ef4e7802ef40c8fe0359cc0bf52ec55521a25f0ce989054888156
- MD5 84aa6859d35bef77762d101cad24e585
- SHA1 0cc87569867093462f935cf1bc9b75dfe5bad50a
- SHA512 ba95a5cc3eb5cc0dcbdaa675ae0f73b16fc1e0d73613868d573c43b65e302c64058205d432a7190e282d76ed2d0a151b5676af119ce4d8e7d36c8e3340790fc7
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID402_ID_8347f6d9-6043-4145-b14e-d8dd54c81ab9_info.cppol
- Size 309B
- SHA256 e138ad0574273855ec53e2ff12b1df1cb184e683fd065c3f58a0150e87af8d2c
- MD5 d03d1594f0ea7266e45a1bb410e8d1eb
- SHA1 457e5740bfabd385e70dd242d87a5226b80da10e
- SHA512 cf1fd116c057b75d0e6047cba259c0c92285c26f9f269dcc08efedb054b8ca852b1a9110fd869c7a964770c95ac40fbe92e2770e50ea4aa1611ad43c0ce43755
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID402_ID_8347f6d9-6043-4145-b14e-d8dd54c81ab9_info.cpprof
- Size 469B
- SHA256 da45dd3650a94a531d840aec35121e7fc743f17613b936566e58e0aa959c4e9d
- MD5 382931326f9d07dc45c9968298d11361
- SHA1 f661bcd596833aa6028d9a5afb0dc4687ddd5fe4
- SHA512 39755fe4f30b97c439fdcd8c443d95a1a25deba14e914b52a13e161cb66c540c8404ac26ce47a8cec3015ef63b3169ccaae0982e91a04fc760f9b7506bc23e5d
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID51_ID_60ec316e-7dec-4d16-bcc0-50bb79c7cada_content.cppol
- Size 3KB
- SHA256 149a9214941148a9b6ec3829d9b01e6de1173b2227277e0152acd76f1d9c23d4
- MD5 8a46d6936c810add16afaef51616c6a0
- SHA1 22c4225ad1b007679676b542a7ad77ca5d89c25c
- SHA512 b1805a46848a4ce2162658ce15e4f525dba0fb7049f748fd81612f2e3f23b84e140aaaaa31266eb940a792cf1c93eeae71cb16480b257f231122bc3ebcf558cf
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID51_ID_60ec316e-7dec-4d16-bcc0-50bb79c7cada_info.cpnew
- Size 341B
- SHA256 b38fdc77ef54988ca55d0ddb265eb2a7113f80455e05916cec1dbfa6ee897592
- MD5 59be98c56c78273b0fdc3a2d2febff30
- SHA1 8cb90a5e30e003e7d925dc2a5f7676a1ea93de72
- SHA512 af4cda93320624c960f00a535cf48f3447882e311677a8774b865c8ec482648194a02c063ab20e0ed38eaa594c488aa4940e209fac8ebc4189e7de79df79d6b1
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID51_ID_60ec316e-7dec-4d16-bcc0-50bb79c7cada_info.cpprof
- Size 501B
- SHA256 d02fa72a8659778c7e044aa79b343532cec266d240cc1989d82eda4cea017f1d
- MD5 12aa4ed0456e7be71f3b293c44ec1068
- SHA1 561d98f9b51f083bd1beb8fd0bd572280ee00bdf
- SHA512 ded626504ed61da5ef74333c87296838bb8d5edde9b26c653fbf0db59df78b25d24ab1f73410fe0725ecd8349c2b898c885fd1beffd359c2eae961422e9fc349
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID60_ID_2cd22a20-afe5-4d62-bba1-e331b1947e9a_content.cpprof
- Size 116KB
- SHA256 ecb6a587692d9ce7838ad7f4dacb74a74882b6a3220ebec5c3088e735d2d2382
- MD5 66d981e002a48afdb8b5ff0e44e0d666
- SHA1 6d54c9d1d29280bc770189a6b2c90661fb50f6a6
- SHA512 c068e2e0be8642a565326d0dcd78fb9385d9663f3f1fbab2341149df41b8832acfcf3206b49845fe947b4bf8c6d2fc4e8dee21e2f30a1cb22937ca05a21765bc
- SSDEEP 1536:H3PYSAqduRqGQMKJm9/yEpAWFaf7b9uz8qEFd0v1mndQyH1uaUJyf1o0:H/YSpEXQMWW3p+DQGd08dQyVuaRdh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID60_ID_2cd22a20-afe5-4d62-bba1-e331b1947e9a_info.cpnew
- Size 341B
- SHA256 dc4353c2f164402e15d5aeffaf9c446934b1aa86268c09ce4adf0f90c71de37c
- MD5 30da699143753ddc820f6d844f9f8ea9
- SHA1 9acf46187aa0c682e2c24914534bf844ae7eb0c6
- SHA512 d96450e217dcf1e53d2c70ecab31381146dd5ed637ec0bd67fece1f30afc30229094c6224fed9c61b23c70a6c61ca0fd0d2b58fec42483e83c66506a38639855
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_1_Pol_CPEPS_SID60_ID_2cd22a20-afe5-4d62-bba1-e331b1947e9a_info.cpprof
- Size 501B
- SHA256 41ac88719e116708efd486bd18467fa1acac8a4922c0f534ad49e2b89231db74
- MD5 0a3d070453b39f05b2f904c1649e8094
- SHA1 054d3c24a897be0df6860cb820f2b13d287c9598
- SHA512 34b2d7535c451244315d5975daf3252d92588ded19e7143fb43f5a4ed425494c56a364954f952ff9d711cbca6bd11b9687aef5b88122bdcc60911f3b695ef4c1
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID130_ID_0e7fd330-6617-4407-907c-4a89c5e357e5_info.cpnew
- Size 341B
- SHA256 76e35db5d4d2dc0baa6d60fb9b80da01ce650249a0e1c1c04518e0f0d0dbdad0
- MD5 c3d4af10d5cb71cb9d05f0e5d7052a7a
- SHA1 082f41500905c84374486877cb90173a88e78c34
- SHA512 0a96143f36bc49b41c75492b3ca2f742413f174a6f02dc02050a662b91b24f2504d3d5d5e6c658b5a40c15b2113915a7ad86594c7056e3e2cfe7645eb88fdfa8
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID130_ID_0e7fd330-6617-4407-907c-4a89c5e357e5_info.cpprof
- Size 501B
- SHA256 309e901bfaeb6107e743b9896d787d4fc256a438809a92635925bf5db0b48c6e
- MD5 dddd397f2b33911d6b6758d1668643e6
- SHA1 ba78f1dc3b54a443f7e132212b0f9acb28b7b867
- SHA512 02ce3a9f76095643a00aa4a7895c89d1c87666d06dc2deb605183329416a929369906ee2696323eb396388ce5e5c0b9538ad7a31e6d1992b3c818ca0f4ddae03
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID20_ID_a1103e73-e68e-4d94-a499-a60d058550a9_info.cpnew
- Size 341B
- SHA256 30a4d4c0fc75a187d0b930a937a1c8015e51272e4bbf5809cb03636f333ec0fe
- MD5 dc9541f1c9ae83534362d485c7fd2130
- SHA1 8c08510ec76bad2b0b5742c447a98f8ed8b34fec
- SHA512 5d11e96033596a9304d761a42e89ebfd8205a474ec4acaa3bdd55b57ff9c90683a9bf0770ee0b7a6c552ed3f5887742ddc0e7ff28c55178a24a8a186705619ee
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID20_ID_a1103e73-e68e-4d94-a499-a60d058550a9_info.cpprof
- Size 501B
- SHA256 611d59411dd94008a4bc4553960850197bc767b37fca130598e4ee2ba9fe7044
- MD5 d714ac0386312fab4a40ce2d48d32694
- SHA1 b7adbf053c1bbd27dfb84bdc299dd23576b14f58
- SHA512 32827ee0462e052d68365cf97128c96c9477e8a73b405638a2741850cad385bfe61d9241618dbe8ef77f26a14386943d5e142b03fd4c15c31337d3dae96a7609
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID60_ID_2cd22a20-afe5-4d62-bba1-e331b1947e9a_info.cpnew
- Size 341B
- SHA256 5c709aefee6c7613260d3565e9a1cf0bad8c988c28b1220b9bc9bafb19b609cc
- MD5 5810ddf82b2e1f6a1c99d22f7c8cd5d1
- SHA1 0f68db98b94d75ce76d0d13fa82fab22f9e7b97a
- SHA512 69b71e78325f70ccc8d283391e874fd8649e507bdbb7d99b8ec0b8a8a28cd0f51b3bfa3433596bcba40423f236bf3d0a6418cb7a5eee297914cf46f45b76e6b0
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Admin_S-1-5-21-1815711207-1844170477-3539718864-1000\PAC_2_Pol_CPEPS_SID60_ID_2cd22a20-afe5-4d62-bba1-e331b1947e9a_info.cpprof
- Size 501B
- SHA256 07e83fd81aa0be5b3b8b05d406d2a434ea2c3225c13c448a48f0d28f7e63478c
- MD5 6a1ee431e5d1b410520d3c68f9628d9d
- SHA1 c31b43bc4cfeb01d5091d5fff58699a0b4e93485
- SHA512 2900eef622c17915810dc9521202cb2af403c359523a05288a5e5d1ee5ee9dd79bb44aacd897256f10b0d5a19218655ecaacfeafd38b2525123f68dba543a5cb
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID120_ID_C93B7053-5378-4415-8D62-1A4EFACA68E8_info.cpprof
- Size 485B
- SHA256 e470eae4c23875d79c93130cb30528141b788fd00332bce286e4741e9653d182
- MD5 3a33bbbcc400e5ab5aaea3726d26c34d
- SHA1 142cdeaf7f06bc8cd34e1defd446f1dc68efa5f6
- SHA512 ae9a43ff46852a5dfffc2a8934a2ccbee667365a2c76f64a45428c1980a9c5ea4ddfa483e5ed5807b2e307c2a187f2e33ffc105d041e3103c2881c484581e715
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID120_ID_ee67b7cc-7ef9-489d-80f4-5600eb2c8526_content.cppol
- Size 29KB
- SHA256 2dd2d5c86d056c2c3a51f41d9e540457caa489cad45f954aa48b3224d286e3e6
- MD5 ba0dc06d9127696de5eff708249bf036
- SHA1 71de6134ccdef806579f667e6717186cf43c6493
- SHA512 cdfc1e9c18f6ddecf167d1a88080ed23e8ff1a18559cbc6fe3d9fa4fbecb03f967adb368b66d4e046a25dbc76db021988e53be552d6ebb912d64fb4f7e45432e
- SSDEEP 768:Tz5AQT/3JlpencFRLDgUW7NCmtBeaNPWxp8O/5xr:TzSQb3JOcFpgLgKBFNe/8mr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID120_ID_ee67b7cc-7ef9-489d-80f4-5600eb2c8526_info.cpnew
- Size 341B
- SHA256 5201914862f9a05ebe3cec5fad5e4299df93996b638463bd7b9cc5be127549c3
- MD5 0cd91f7532e98b62a8e8e27187627e31
- SHA1 d12aab17914c2b14648e185c8be45955ce2a69c0
- SHA512 5ef81dee91ce50e109211a385f29d54176eb0cbb0ec6bc39761f05d79a644d65df4d3ed96c374bd0595abf627c9000ccca77d3be81da9be0cea5544c2e2a1e44
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID120_ID_ee67b7cc-7ef9-489d-80f4-5600eb2c8526_info.cpprof
- Size 501B
- SHA256 ac282e1daa5c138a20c98cbe84c625d2006982c75650748fc7ba7caf49c38d72
- MD5 623d5e1d82741cc71625e79b6f2ab568
- SHA1 4bce2d2c06c6564b17079c077e7f9c5cc339a1d3
- SHA512 f2ab028eb76da59b8a1c8ad85f4a1ee741af4f8882f69fecec3c2968c45a90e7ee6bc04fbb5d6f3b99c853e50662f988b6eacc4220265eb29b99fde1205cbb40
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID35_ID_00000000-0000-0000-0000-000000FDE030_info.cpprof
- Size 485B
- SHA256 4e8603b606be7720c583c80e17dd24bf6950c004c3fde2c7ba42000f0b20df03
- MD5 dde11a39c603434ae8f77fb910374161
- SHA1 47e739ea545d24a9ff9ac42b33a6197f1d42b3d8
- SHA512 d72c56409c5845c5416b6ee3a6c766ac0a305520cbefbb85e3f20fe8d4c8ed5ade0773b7a319569ae8c5ddbbace09d6fe42ba7c8a694cba5a407ed24530cf973
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID36_ID_00000000-0000-0000-0000-000010FDE030_info.cpprof
- Size 485B
- SHA256 3035d5b0b85bc69ddaad53cf6e3181083c2ce9f30bd6a8efa44390997dfd0b17
- MD5 7db2234cbfed1407e8be96f139439f50
- SHA1 a6b73f48cb87569e7fddee8d279f850b8fa004eb
- SHA512 dd83f08a02ce1ede54328eb3a0c6db9b07e9770e235ffd3d1d6c256a27010c5063def7d85df336713260525dafb4dd7c2b57a71b73d50b85cd4d468705895f60
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID401_ID_716bfb88-d0b2-468c-a3aa-b6594ec33a33_info.cpprof
- Size 469B
- SHA256 6eb9b7b81e85bb937561240cd436051e80896bb4b7ea5760017b0617f9645815
- MD5 2079dabe435491c9ee7b347b6b00418e
- SHA1 dd3292fe012b6cd2bff9f7eb906a686fcad00b3b
- SHA512 4959c60f77d4169015908cce7cfb7b429285a12666590a11843e863cd9d63abe5420ccfd6acebfc3b6e12fd04ccedf825e277fb57a2b936b3319dcd58765c2fd
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID403_ID_2ec21454-0d55-4b3d-9f81-cc1bac1ac100_info.cpprof
- Size 469B
- SHA256 a99a8ec24456813d6059ad4c4a16554e9d24ad190871f715f95ac68196ec2fbb
- MD5 b29b7b4681413b3b53f5c8fbae443db2
- SHA1 5ebbd61d1b6890be7c2c0129c352b883172bf215
- SHA512 32806fe96ec77700412ed484dbec2b56797b875260bed1e3ae46ee382c6f87f613085c2bb6a8612fdcaf721d9ed5a7aca5f7cf9a426efb342fd5962f526194b5
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID404_ID_c7010c45-8265-4d2c-9593-6782a27d8ac3_info.cpprof
- Size 469B
- SHA256 037286dd347d14bfa627be4e6209701012d98c8272f2809031faa09cd1430973
- MD5 facbc2a13c7f58dfb732b140fddfa135
- SHA1 52d73006d2ee6fd433bf1c15b0e781bd38c329e4
- SHA512 2c306275aea3bf7ac526b45bbb7b8184ccf3aa82a6195f69b7e4725ec05bcc1728d26f918e75f3151819426108e2317587998ca1c8369c10d11b8cb796f22a8d
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID406_ID_04dbf672-7ab2-40d4-a3ca-2bb9bbcc4f1f_info.cpprof
- Size 469B
- SHA256 64d904e35cbf76876001d33dff63dfb7079613906ad97133d8e07f031dcaddf4
- MD5 6b55ee50329917f7781ff8d17ad6e526
- SHA1 582d302b0a73e0f2a0296d1f030e822950578e9a
- SHA512 ca9904529a09de3679cd32741a9a6ce21dd04d09d4acb0d57d190a34cb91caf7c4d16cfe37713642f16de97651d63494e90a2533bd8e3e9fc4e2e68240928c6c
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID407_ID_d67a17d2-e16d-405e-ab57-8688fc9d2dd5_info.cpprof
- Size 469B
- SHA256 d7cc7b4c75c4b8a695ceddc85fe4e9145b0c66e5a7e2dbffc04d22ce8c3f3cb6
- MD5 ee1ac34727adce54cec5275824d770b2
- SHA1 3133acc5b27978d1f02b2048507d98734faa7654
- SHA512 beb287351360e50580f574a69b65e2b1d7f8d4fee0abaf56729b3350b00fbb72c1c7940ece64ce58045f4f502dbedd4c76eff0e802b35f618ca2b1137dbc38e7
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID408_ID_5b6a5175-53b1-49c9-8299-c772d3188718_info.cpprof
- Size 469B
- SHA256 a8ab65ba4efe8efce85ab6878f2c88907094093c43a9cf2b1e11e5d418379ebb
- MD5 a1ee4c695ec3b80160e6f00b68e0db83
- SHA1 07ee1705efaeb671ae0ad7d6c503f68f59bde78a
- SHA512 10c42079e219d0d0e9957076f57fa24e2a37dabb751752b6aa4513204b59f5514673ee10972054edc040069aab125e01a00ae59d40df928ed6fd92e35230502a
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID409_ID_4698096b-99e6-4e6b-9083-311da58d7871_info.cpprof
- Size 469B
- SHA256 6fb149b7e55fdc2ec038add1bcd41270c1c3e485afe28b5ad422244a64a527a9
- MD5 99c5f747022cd2bc34b08ae28e08bc87
- SHA1 2779a3ee3ede0affe43a952e5c97256747834a6d
- SHA512 2a21c683764d4daf7ba8da7addfec06f6007a7a9791a0c64326699edd04847dddc9e049b5a30b2eb3423be34361077e77cbc106e2f1153158878e5a200159345
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID409_ID_cc711efa-ae78-4c07-8b61-367e381a92d7_content.cppol
- Size 421B
- SHA256 caeda355c6fe4aa2885ce6256807990f7aadb4e08e6f32bd543fd6bd802f4534
- MD5 7f3e47d854a0d0cbe7a4e8bff92407f6
- SHA1 d4102983f58a77ab19ab8a6023f528de22ecaf00
- SHA512 dbe370af14809ea1fb1a088a7ef80160d25fcb8105e9a5f93175d9ff29a7f61a929f156aa8920e15a49bfdecd5378e7e14c967cabed3fb6a58a216976852f0ee
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID409_ID_cc711efa-ae78-4c07-8b61-367e381a92d7_info.cpnew
- Size 309B
- SHA256 c0596dd0eaf98ed133fa11011a379c06ce4a7639e2ce2f3329d10801dd7a0872
- MD5 5045a8f55163cc13caeb49e97e02b09a
- SHA1 c300e1d527415fab4b15ffef2a84b2af27d804af
- SHA512 4f16c4f2f45b07ae275f488b2652cb410ec2a4d5a8cf07f188b2208fb01cbf1f602e2c04a38afcd071716880eacc3cbf0a7d5da1362b395b6d15d1a3d1c0afab
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID409_ID_cc711efa-ae78-4c07-8b61-367e381a92d7_info.cpprof
- Size 469B
- SHA256 a6ee1be47c525e686d78a4d10c4d13fabbc41b0529e6e1c6cd6b5cfedf190821
- MD5 5888ad93044c35dad7d3ca0ef2c32c60
- SHA1 19d696f6db8b6e013139ad45bd4aa6f205b8fe5c
- SHA512 813be34a4aa8074d7ad89a99346902a24f822182eca5c9ec3171d2e094222d5f4f6e4a4203232660def9a10ee3c19ad03a4187d5035abb121fce69f7876e3647
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID410_ID_e555a654-08dc-41a0-b732-e5b4b9cd0534_info.cpprof
- Size 469B
- SHA256 e82fbb7a11e6444df7b2dd35fa14ba49e4f1ec86db5c934fa22dd930e6564da0
- MD5 3014464bd58912a5b7e2261aa538509d
- SHA1 6ab84f9c25c488af941719cfc3f9e51bfe57c1a8
- SHA512 1f105518a959063ad007ebdeeaf8ad2d8de12b46e3142d3e065838bf1aeab7adca7a181f0c19967334c33776d365e817ad7d102f4cd3d38cd67fe502270d7cb6
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID411_ID_20f2a400-f568-4f3d-9214-a48b72bc4012_info.cpprof
- Size 469B
- SHA256 e6b9f3045e3ef0a346a5668181a7ce09a1594ad955bfcb1f8cf58a0867b87bcf
- MD5 ba0a7d031c750f9023e1f6e3a32b3125
- SHA1 34c6733067a5e3c20ee9fd8c1002c0cbc78b4ba4
- SHA512 2418fb7d18daa24a70cbaf1f65823c20035d353f45b72de34f32ed8a7160e0f91ab15cdbeebd65577a7abfba16996727900b6c083b8ef472b77c4fbbc26dce11
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID412_ID_fa67109c-012d-4192-b72f-c20b0b5cc1ce_info.cpprof
- Size 469B
- SHA256 bfb27a0de0a79e6c857b34ee026fe6cabf9be0206cc54addd26764047ac4bb94
- MD5 a3f509bde383d8267faf9b79e5662ec1
- SHA1 04033cc92258d49e312269ce287dd9311d572194
- SHA512 ecc81f9b4349e99e1e753675fae49abf148b74add9261bbb119e8a7a2797fe8df38835a3fbfb25ef10abb49692ecced38ecfe9d651e09ec815a2790464c419ef
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID52_ID_0c6aae72-170c-b35e-99b2-31d627137426_content.cppol
- Size 565B
- SHA256 08146bc96a66102b6e7c1f5872e2c8b9c14bbcb5c63a4d63526f1031def209ac
- MD5 ad0ecbd7593dd26762d456fd9e011e69
- SHA1 0ac0d2cc7a6a4cc255416f5e826fe657c67e70c8
- SHA512 bc9d4103e43f0236d93c678647ac0f5a045acac769b0a8d5c7320ebb5b0002d96550785c898c175cd790e77667434a9c19d9f8245fc927df01c7541573328a1c
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID52_ID_0c6aae72-170c-b35e-99b2-31d627137426_info.cpnew
- Size 309B
- SHA256 4b515dd1511e35dd22bd78a90251b03e8eeb69dae937f46eb8f18e761c7e98fc
- MD5 ac8e427d6b4809d5bed5e00ef1563df7
- SHA1 f1b1b9e9f75f4a5b63338190c3cc6079f6c90cce
- SHA512 57c3c9557201d607364bad3a952c6e4321858c078160889cb3a4c7cd7f9ed0c3e44e6b6e27468286d3378e6e24734f30b331e4b46c950577906d8cc5f360f894
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID52_ID_0c6aae72-170c-b35e-99b2-31d627137426_info.cpprof
- Size 469B
- SHA256 8f462562c699cdb7d2c4bb87ceb8dd3b55d4b4894ad9378fdc49901d42394331
- MD5 80d52c0b44ab54b335e2929a374cc5ef
- SHA1 f44b7e4c8d561160f6df10625e6eaffbbeec6f3a
- SHA512 831f2d016c746dcf442bac72e4265e592143e596a46f1c41c9f052ab451a7102203c1d6e9cce14066179eef2f4fc2efbcbc6636bda022598b8b52008b34d74f5
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Common\PAC_1_Pol_CPEPS_SID78_ID_5D461C82-7AAF-11E2-BAF3-0050568B57B9_info.cpprof
- Size 485B
- SHA256 370124180c287d3d2ccf8fdbbe52d02dff6fe585b46a0c0a9e2e83da46472a28
- MD5 945e741b29e01277a8215d0485f84126
- SHA1 8d6529d00d584528cb22ebfb3aaf6e5446d978c8
- SHA512 775ce9b62774c3fe5e66e448871396d4edd93ee6ffd7bc7f40554ae270b79dab27ed9a96de6509b3513561e39667c4c7566d639219f113c7403c183e08e9aefc
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID100_ID_EF1134F4-06C1-4922-B217-37B8C24427E5_info.cpprof
- Size 485B
- SHA256 5faaf4944b6b5721481a284ec839396816086c52ba187fb4fe30e5af6a817a15
- MD5 2ff01d2b4ae056bf996069f4acabd3ae
- SHA1 4bc91ac70d43ec3c043dce2e671a8964d6ade436
- SHA512 30b09fb14728681076dbefc9c21e23e2ee6ca42dd9f996c792f979e3b37c38e3c20d9c34d522172bd554929f3f862bd0358d9e4e0c067c19bf60819ba62b36ac
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID10_ID_00000000-0000-0000-0000-000000FFFAAA_content.cpprof
- Size 4KB
- SHA256 93d1088a438158d2ec18bb7742afad3a0a1b0bf50467faac13e897613681a9fa
- MD5 3bf93523732787e6a2d9f2093b192c70
- SHA1 216e8189b9c22bf95561b8e1dde4df172c404ba1
- SHA512 244b2f4837b516e5003a067f8eab03f08a2d396033f899835f045cd4b508903bb00b5e8f82a41f0f005b642a1551da1ca32f77111a6dc0c04ae0e4a9508501ea
- SSDEEP 96:4u2IbrMN5Q7LjgV/t3cl+qMmOmXVujb+ElX:4upHq5U6/a+TaXM/9lX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID10_ID_00000000-0000-0000-0000-000000FFFAAA_info.cpprof
- Size 485B
- SHA256 350b18bc97ca7c51aa2869718ec355e405256981a99a56e7d830ac9ef2a03e9e
- MD5 2af77936d9caa893ec4859c31f551c4c
- SHA1 3924c7edeb72ad1071b52542e64b9b18119e7e95
- SHA512 d6e453c0400271a94a470401e99d7ad9351f8f6bcc836d31b64742200165dfeb8f8b78e2f7d42faa8b8908632f6395982e6b2c5a45206f224d1b7b0f14c74208
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID11_ID_4D6E7A86-1918-4DB2-894D-DDF5115A56C8_info.cpprof
- Size 485B
- SHA256 d0e687abeb2903c5597d509003fbb04120f4e12a1313745a75dc69b0abaec58b
- MD5 7adbaa7719d3e0b9f0598e691cd5198c
- SHA1 f0bdef70ffc463cd4bc5ca9df81cb60074f45203
- SHA512 ede7c694db6a72e3b49e747895fdcfb67a3b06cbdea4d25ad48237cf5ba1f4b5082521919c2b826605d1d780522c9a89e0e1dda7543ef32bd13faedec881f410
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID130_ID_1C7D3E9D-3AAD-4EF8-870A-F01EFA586628_info.cpprof
- Size 485B
- SHA256 de3351493fd8417ee8499a0b8dac7f85406c6bc98f71ca10cd5ff1585c7f2839
- MD5 cbffe30512c6e8552d62c4852160152f
- SHA1 a8c4af2815cc750e005d1f37641563b04fab993c
- SHA512 3cf80b9bb7112591e997b68d037a7c065580dccd9fa588992aae62d37de4c34e059538060458686b8bfd98bf94e96e74cc405224bed6bcfabd740f803ea6dd61
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID20_ID_00000000-0000-0000-0000-000000101111_info.cpprof
- Size 485B
- SHA256 86bb95fb5f708aa9b1dc0b8cdfa999968f6b62e8f473cc3e41cc32cb60d9c716
- MD5 1e463c7ec084271ec44307982849a677
- SHA1 363a8e5b2a8e3589a6b661b2fd6ba7300c17955b
- SHA512 3f43cac166a270e571e36d55761d8ce5d29ae8bbdeb0bba9cfa594cb940589dea629ef6ef8ad0241358b7e6574e942f6f0fa727e6bd9c65774244c7c0ffdd042
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID22_ID_F13A30C5-D399-425B-B4E6-BB4B8FC57AFB_content.cpprof
- Size 5KB
- SHA256 5842a315755658304ed6736f80d7d91927a19f9e631f6b7fa73d31d4e70c0e74
- MD5 bcf6634b7307825c74d2427803632abd
- SHA1 de4705a99166378615e496439cb16a549631f2c2
- SHA512 26e78451591835105e8d8b227e8e463498b3f8e34cf5f8f020a842fc5597fc00513594471cef5cec6020a68b65e5ed42e7153585624f68bcd4af11ece1006511
- SSDEEP 96:rEEPXUHvz8oIzS+6LnWoTsdrNH8fbE8C0S3xAi7eeQV1vMk6R78:rEEPsvz9bnDTSoo8CtGi76bg78
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID22_ID_F13A30C5-D399-425B-B4E6-BB4B8FC57AFB_info.cpprof
- Size 485B
- SHA256 332984b02154e67095cabe00141f92c0e88f8f24fa01e2da0aaf03b702454166
- MD5 9031c011e0dc0af0b3caee1bd6b1a758
- SHA1 81e729c665f827da11efc393868e27a59c2f929e
- SHA512 8a399fa5307a3fe27a9b19ed538f4018aaf13870c1177d7ab127a4a23514d34f232e923582402701e8325a096374f714d0df52ae9eb657869e22c3b67a4ce9a9
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID30_ID_E427E7BF-3942-4769-B943-F22A209EE054_content.cpprof
- Size 21KB
- SHA256 0b6b4f1e9bc8e041681fd56b68dd2e308dc7e397869fb1b3737ab2201e234403
- MD5 77d9e93f7732f08428e9ce0d8d57a925
- SHA1 43d5c1ce9e0d11edca1d3589ad229ec6d8b312b7
- SHA512 87864d8160b7acfe60de304628442f1726ad57dfc1397b3fe97eb474a6116a11cb319ba2711b8e05335a0844a8184632e86ae607d16dfe929dda92dd4d85c51f
- SSDEEP 384:fWN5gUoyHC3AaLxVYFF/ApiVPu+zrdH/5YosLpIouTdMC5JrUaY6D0BbhJZkUc3C:eN5E3AaUFIpiVmgy9IWAUOusUD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID30_ID_E427E7BF-3942-4769-B943-F22A209EE054_info.cpprof
- Size 485B
- SHA256 fbfdba7108a9fc909a1e2d7d12ff73edd2e4153768f3240f0010c29490d01827
- MD5 46fa3185af4f487f9c00c348622a659b
- SHA1 56efd582acff8561c80bf873dfee4a492bb0267c
- SHA512 a1939e21546406ae1487867f99cefdafaaae672a54cf5b78121e2ed46b2f81ad6c28320b80305881c86fec415cb44b33a50bf6dcc04fb5f187d1d0b194a3e25a
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID402_ID_8347f6d9-6043-4145-b14e-d8dd54c81ab9_info.cpprof
- Size 469B
- SHA256 3e1fa21963cc64fc9e1abd93996089c4823a08c75bdf52e70dfd30d873499325
- MD5 0321e11dd2d61591254c566b8ab20f41
- SHA1 a3e65a783c8361bffa0c1375aabc6f4b1becbb8f
- SHA512 2de2bbbde4b781e0b1f715b06f940600836c25952df2a16ea320dbeb42c9c8fc1abed65ed047deb5e1bf86e8942cb34dc99aca3453a542fcc7ce24e182689efc
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID51_ID_770D1B19-2262-423A-B29A-9D2D70197D6A_content.cpprof
- Size 3KB
- SHA256 171a1b74007d2f16ea5e7bf078ee656693b673fc1a36494ff14c3956e9fafeb3
- MD5 4870dfdd9e835b432da623254eb9fc01
- SHA1 72b1b117318982ce57bcd463245fce0eeab8e3c7
- SHA512 e6cf905c2c30bdfcb6963748c82dea3effa8f9617966041ff57b8f3e4a28b58836fb0360cc4fea6a43112c43af98c77e4d6658d8076ffe83522bbe4ed4b18929
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID51_ID_770D1B19-2262-423A-B29A-9D2D70197D6A_info.cpprof
- Size 485B
- SHA256 a40c63bdc3f67914e0eba0153eb8f9c3adf319ca9ec9e8601497821b28a58fe0
- MD5 2fc601c2a394c27ebadd99bc26a343b8
- SHA1 d14ff1a48cf718bc72b03dc8041fa14bb23d9bdc
- SHA512 cadcf0116158c617a43c4a94c3114ff1ea9735c170703c91edd32eb4f4fb9d0f2c7cbf5ebfb63d90668a6cc7127d2e10ea6487f07379720be7d2df5cc56974a5
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID60_ID_00000000-5555-0000-0000-000000CCCAAA_info.cpprof
- Size 485B
- SHA256 c34dca52626ae6bd5178fd7c9be2299952c33fa4b0a71088ef8cf18f79dba430
- MD5 3af8149fc1849d3ba50e46144c5af87d
- SHA1 2413fb0d6aefa2e924cdcff546d4d665bb28de04
- SHA512 5cc7a9c0a20cfa87317dd144fbad50eca40cfb4d25f3503c3375dc8719d7ac050dea3d7bc030b2c8e3c90e0d0766f26321abf1dcc8ddea5f2b289a73ad39ca95
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_1_Pol_CPEPS_SID91_ID_B436918F-B088-4A8E-BDBB-4EE5DCB3E37B_info.cpprof
- Size 485B
- SHA256 731141e48a30bfa79c7bb51ebd4790081cdbd5bcf481939a354c60e6876cbdf9
- MD5 d11d65e68525c4c2b3248879e17cb1f8
- SHA1 5b993671f77da74945b5fad6e18e2aeb85c399c6
- SHA512 ecc90da890fbe00767d3a14730eb4f609c61479ad5105bdca65d2a8245341341d42f0253cb995f71df797e4453ceeb76e80f62ff5f39fbf11d573e9f5921d1fc
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID100_ID_EF1134F4-06C1-4922-B217-37B8C24427E5_info.cpprof
- Size 485B
- SHA256 17c1ab58010efb96ec524f0820a656ea9b78e09d4df1c18f4a1945d8c0bb5389
- MD5 8dd2763affaa5c6f2e6b169cef75f16c
- SHA1 072f5b9036dfabf1f3ada30d4ecc5db33e80bab0
- SHA512 2309c11ccc340ef3d0ffd7bb6283aa75e40bc0dc67ccea12dea532172ef8074fd2966260e62200c76efb08ea6ce03a5218eba6f2e0c84063ae612d26856b4023
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID10_ID_00000000-0000-0000-0000-000000FFFAAA_info.cpprof
- Size 485B
- SHA256 0adde86598071f40fb7aa7b5146f446224206d63707e1eb139dd98bde9517395
- MD5 3a2d43ec82649719a469b93f909b2cd9
- SHA1 72214b24daab5f082bc3e2e961ea2d11f1776a25
- SHA512 8202c9614eee91fd29e558e105bfcc0812f98ff2774763f4a6d6d94355ed6aa5928393699468af961fe5c1ccb9012354c7d1c21babb930547784210e6f57467a
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID11_ID_4D6E7A86-1918-4DB2-894D-DDF5115A56C8_info.cpprof
- Size 485B
- SHA256 0a1328d51c945f92c76ceb8b7a11bf3c82ed6e4f7a9660a9fcc68778673b7d8a
- MD5 f9ac741c73f751fb49c336e9dfb40911
- SHA1 6fe6610bdb1900c8444a50de38cb78d704b6bae4
- SHA512 e8e2fddd955a666f543c311f742eb3f8e942345002e5633b0f26e0117a369a8042535ff2349edb1a753de69c48a8d33fd29eea24575db3f6986a977a424478fe
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID130_ID_1C7D3E9D-3AAD-4EF8-870A-F01EFA586628_content.cpprof
- Size 37KB
- SHA256 10b601ff809bb3b4e1f8cafbcc4888189894cb1fda23dd9205618e2af522dc3d
- MD5 0d92e2775ddc8df306e3f2a0720fae8c
- SHA1 444368a7cbba4b6e0cfe39007d9403a2e593042d
- SHA512 65802aacef6ec036114e45af7b98280bd0b107d05220f435ad4a3621dfbd4c643f440340f92d39bfd96ddeeb62c42aff5c5b830c713bca49cd93d9a4661c7e70
- SSDEEP 768:70oVDhkWfN7P7cPO2wpFDzPn5EI2ugYAxOua:70oVVfcPLKHPKI28
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID130_ID_1C7D3E9D-3AAD-4EF8-870A-F01EFA586628_info.cpprof
- Size 485B
- SHA256 081a1e2bef8a3f5b16113a984a0d9b426c91ccf2009fee2918bda23875f24aab
- MD5 10bed182d8e44e4957165b567752427f
- SHA1 9c12202cd478f85cff182474243970e03581b76e
- SHA512 f65f42d6050399291422c94f8e79e9ba622ec75e2eb93cf8fe08e1f3776dd7f9135f6c1f12597c7e9b1e3d846c97615e8f2659d6eac2931028c8d6e1fc53aa15
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID20_ID_00000000-0000-0000-0000-000000101111_content.cpprof
- Size 12KB
- SHA256 6f3399a29bd6300265b7eca8ca8230f0be77fcf0f5372066329dfdb09f666df6
- MD5 5eba685b8cafc7b90937f222b992691e
- SHA1 4022d967a9b5b9096511c606e2f031ae14755a10
- SHA512 cd6f22501ae4a784de2d6aa03bc375f52fb3a912c6da2cb513759ab38a50def5bf9adddb86a806aec5df12fe0502309053f655daf8683dc4f3baee5596a8fb81
- SSDEEP 384:98+UXG+xr7LTUScWLlpT/bjTsbX6Ed3ElFoWN/:aPXhxr7HUJWLTbPYfElFTN/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID60_ID_00000000-5555-0000-0000-000000CCCAAA_content.cpprof
- Size 106KB
- SHA256 30ddfbcb42dce249014d3f7393b92c910880250908019427a6f52b83d3fc60f1
- MD5 7906663f99c3eee280b8f1368b39cb9a
- SHA1 ad248ad1345adf6a1ba35e7579a1578661da53b9
- SHA512 79e85f5ba95fb3a1fcc0c842374736ffee221d0f5c613dedba0ef76d911ee1f55a12324222324a47c05d65f0e2352f40c7734473c605936c594b33f4c053f3f5
- SSDEEP 3072:JY3pkpu8eN179HgCHgYbTzlGpRDEj2CAI+1rp5xLC8:J2kv2179AQgbpRDnCAI+z7C8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_2_Pol_CPEPS_SID60_ID_00000000-5555-0000-0000-000000CCCAAA_info.cpprof
- Size 485B
- SHA256 9209591418f5c484d8164c37fdaebca3ebf5088f7114034c69b707a17b3f527d
- MD5 661f82f8f81a3a2097ab9ea42566abd6
- SHA1 7d4afa0ec1c14b54b4ec2be534aef25271ef28a5
- SHA512 f13daac71dd54e9542eeba8f064360774145f015cf4015a057dcac3ae43a23039d0b63c534ea113f23383c62569e7963b3da8e2f0ca41e8913f7979bba760268
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_3_Pol_CPEPS_SID10_ID_00000000-0000-0000-0000-000000FFFAAA_content.cppol
- Size 4KB
- SHA256 0d7c11dd8b890d638e4bb430bf9ba094f056f9e532124aeb6773ee5634e94777
- MD5 1bccdf9697861da5135a755799d5386e
- SHA1 b3fb8be754a976fcaa4cebb65d643244dc7e0aab
- SHA512 a7d67f92191844e3be36c65bd534ad29f51fac8a6b488e00fc9fb2540943cb074301fce023de3c8b9098f0289754b85e79ff91b87cfbbe4772ed3c274c536def
- SSDEEP 48:aPrLWrLl3rLsrLq8h7GlwGXEp/1/aUQG+aUQrDMDXDwDWphaUQrDQDl4Vz0aUQG2:T8h7QEpAOZHwzcWeH8lwzTOOtRrLd/ln
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_3_Pol_CPEPS_SID11_ID_4D6E7A86-1918-4DB2-894D-DDF5115A56C8_content.cppol
- Size 1KB
- SHA256 c355602ffe9f6e460a2cda6fb1fb03e4a2de11473819a5c2d0546d7d2b1d0dc1
- MD5 9d7ad7a8a28d1a78824a5797019b4609
- SHA1 8c1ffda4ee2accf67da989bf490878ff889016c3
- SHA512 d15110d8eb1212e45bb34fa3cb7c7f1cc18a81a337a3147bcc7ac1f52f344bcba1c3aeb1dd104852e7384ec4b0501def0f31e979fe69fbc628ffc853355541b6
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_3_Pol_CPEPS_SID22_ID_F13A30C5-D399-425B-B4E6-BB4B8FC57AFB_content.cppol
- Size 5KB
- SHA256 f63ca37437ea8f99c16769274d503e445bc34b082c28f0e0092b33f6b2c8f76e
- MD5 50fdcc8671c1674709494d05de1c1109
- SHA1 8d58ca788a77ca0b85b2653f6abd895ee83c80fd
- SHA512 0ad54e4e4a9321650ca0d918fedb9c19b85f9b7318c5b5d864ca3b5c92e2f61954c352b38aad75f99a6c25399275ab5e30355d643f0c50c1e5f78946448127ad
- SSDEEP 96:OpS5w8hiA5/AZ/ij45/AZ/Ey5/AZ/ij15/AZ/VsCEM5LM5emjSFuC9I:OpS5riAZ4pyZ1IPYeK0S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Common\Storage\Default\PAC_3_Pol_CPEPS_SID30_ID_E427E7BF-3942-4769-B943-F22A209EE054_content.cppol
- Size 21KB
- SHA256 1198b96126aaefe221b8881cc132b042c084b4af5e12fb126d98169b639cce32
- MD5 15c6ecb29724f47babd9f951c16e44aa
- SHA1 599c35cb66b147a922a5a899b1a53679dcd7fd9c
- SHA512 7e60785effb55b839f0ef65ee22240713f1e1c55b460a2746c6e3cac81b8d07492d7719f47dc0bfe74a8c23c4b545d4ad919b2ac18fa78bb694aac94383f8cea
- SSDEEP 384:jKaK+NUnKP9vE8HpnHQfIQVQSQpQ6XyQVQ2UQ6XnQ6ruQ6dBELBz:jBvaKP9vE8HpnEa/Iz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\InstHelper.1.log
- Size 1KB
- SHA256 29c64da3f9d2912a131553de1de84f589006c531c8aa92fb60e3067489bbf49f
- MD5 ef24fe38e18700cd2faa5b9575508a49
- SHA1 f3aa4217cb2de1caa7b69ff49f8489124dae397a
- SHA512 630c978f27c2692b096a6309f55fdb44320ff57594aec87970bae2bf2444834937eea5e83a152df66400142215bcb46e80e25382b91dcac010a35b4c233e2393
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\InstHelper.1.log
- Size 16KB
- SHA256 7277541c63862d2ee5e94058dfc242e1d0b704a66660791d1459531a25528d98
- MD5 37784d011e0aea6d1dc17785cca2890d
- SHA1 42b16e2612fd9f237af1c5ce0ec1ea3c655b48c2
- SHA512 9df1c4b12dcce99fc73187c2af0783cf66e376b1c18b97436abead53b7e4094df98bc6430896d4909eecd732c557c98deb3452f4b3c176eb1c010fa914c0b502
- SSDEEP 96:fBIx5kNvvH0ogRvt70R0+zs0jXRDDr8AXsodTiiLURPiQvtLnX9vOv6:fHN3tStp+zsiAtLnp+6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\CheckPoint\Endpoint Security\EFR\IntelTDT\Driver\IntelTDT.sys
- Size 107KB
- SHA256 8e43103ace0cba292f7afc60d64ab90edff3d8049f12f3d4db1012cd1a32e31f
- MD5 2268a240cd385f6008a8d286b70972e4
- SHA1 3bdcc7b137e7137510734cafb22ee47de40986d3
- SHA512 efce0aaba2d82b7bfc3cc4a5c92168a6bca22d779bd6480575d93117356956b1af971c65775a796be6f9a695e5cde953cd415e12d20ee8f28ee1872b9fb9dc4d
- SSDEEP 3072:NhsOuHx9YOyqujv9e8d+X2ure9d1N1pipsc01BMc8/XTjTzbLW2WuwYJeddtJxpf:PsOuRMP4S44D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\CheckPoint\Endpoint Security\EFR\IntelTDT\install_tdt_driver.exe
- Size 626KB
- SHA256 e72f8803c26566b98e9364a80b37a284e07cfd98e09a1eaa20eb288235d32337
- MD5 0534bab59a80825bc288c548aec13032
- SHA1 a792ea8ed54cd332dd7b3db5b25bbc42101bfed2
- SHA512 d28c0647edc9ac1717334467fff4f353314a92c5c1f41c948db06efa0505375f0f6616c78b95df123e411aef526e9adc4967f8ca2837b79f50cedac89b304b99
- SSDEEP 6144:5GjlKmQ0jXt/mE1FZEFA4ZlSow5Low1nh:5GjlJxjXt/1hETRCLVBh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\CheckPoint\Endpoint Security\EFR\cpdevmon64.sys
- Size 32KB
- SHA256 7c4d441db56ab3d8f4fa57560d0473fb932871519e7739122b9c85320b91fd33
- MD5 fef81eda6850de04cd60de4bb0437962
- SHA1 b84b7de10bfd3381da33f2c9f2f96252d3ed26ea
- SHA512 884e2c084fe73385bb41f6c78df25ee2bb000d44caf2f4cf21060d77ad33b59d3fd24e97dbc3c7094b368861ce81370a0598c30d3c8c5edf50151b0ee7a26678
- SSDEEP 768:EXqrHnOn0om2s+vBGwADlPRbwq+wW+tbfL9zY:EIORTs+vNADMNZ+tbfhzY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\CheckPoint\Endpoint Security\NetFilterDriver\NetFilterDriver._64\epnetflt.sys
- Size 193KB
- SHA256 c20cf54a97ba745c072f45f22eee71615902ffc7e312e3475bfed7bf49b31e77
- MD5 9a8cdd9bab4cad99db206e0fc1efc258
- SHA1 33cfd5f004a54451ac9d9d1aac658741fa8efbe4
- SHA512 2d035c351a3afb0b0aba7d10b2827d6ea8d8c3fc3899a62e167d19fc0f3593ef5b20b716f842232bbd520afad04bbe786b542b5c7bfc8bcd404081eb60cd424a
- SSDEEP 3072:+zN4/1sUVufIZ0e5LmppcCAxEAlW2VkrmPoCDKTpWW8CMd+i4jii:+zN4/OfveChAx9Y33UWFJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\CheckPoint\Endpoint Security\Watchdog\WatchdogAPI.dll
- Size 22KB
- SHA256 ce559a4ed26c9520428a4b1b5fa29ce2e7360d7dac6811952194f8036bbc8894
- MD5 fd8f2a4a625db102cf1295ae3f5fd8af
- SHA1 c469caf9934d1f113c10bdc2b5735edec0e0d5c2
- SHA512 e6232d3c78bf787526d8951f169e44a60934793a595440cb664b97e1b35c87e3aa90194d19bc08aa19d9a4a6c5998b8e7ff462d54c1527edcc761cc3e35ef9ed
- SSDEEP 384:S6y+MsL51qXJpXVVQLmEwxXwGBkNl6bCI9IYiuHc:S/sLgtVQLmEwxfkNlT5YiCc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\PFiles\CheckPoint\Endpoint Security\Compliance\ComplianceAPI.dll
- Size 26KB
- SHA256 a8b1c0329696de396c7ed0c680e53dd2390fca69e7ef7c1a0e710d63d16ce37a
- MD5 0344b76f3dabdba99446d6ab80a8901b
- SHA1 98ab009d895e33da0489da112d78fc4e1214fbb3
- SHA512 21cad7b7f8add5735498f27715de5aa56cce2b7d52dd6e58fd114a7455a5b83c9eb3a749872c4631cedc2c3f4a9f09eeeb232e874aeb27e54107b21d0daf4f9f
- SSDEEP 768:U8zILJDHdGjioOzGcHiPS7Ew1kNlT5YiJUX:JIDkCHiPS7EwCN578
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\SysFdl\Zonelabs\Zonelabs._64\VsDrInst.exe
- Size 376KB
- SHA256 3002e519d5011554d10c62f94f60b182bc7807e0468833a494757b39b6f5276a
- MD5 ce323307a1b0b09bf1bfb0d5d540ed24
- SHA1 fb0f2c7f81ac6adecf550be826cb978ee5fa2637
- SHA512 93a99f5fd3e295cedbe2b5a753cb281c7812d8b829c5d7027c4e6dde0b5562eb8f93772feebbe4eac030f17642ae6b3a96ee516b7e5059caf9c15bb3e5a44d8f
- SSDEEP 6144:s7sHOi+z5gCpYuMF31OR46W9ebgG3HHHKxUs2L0OnINvIN0ohAlNid1gq:sHz+8YugE46zbf3HJEU0oei
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\SysFdl\Zonelabs\Zonelabs._64\epklibproxy.sys
- Size 30KB
- SHA256 3ed360a5b86d0d0cfa8201186ac5d50562c01d9d2e54fefa489d8e55901e328a
- MD5 a32ac219dbd0ec53333f22000c4aa0d4
- SHA1 b99238018084263c19e529005ae0f1edca3810c9
- SHA512 ba656a174f43f72b2f65c239f4d46f4426da3fa8c90bfde2db0c79a1b8ba965493b124d967d53b1f6fad55b20c233b7d5fe7c1f43c42153839d0aa55e2ce90da
- SSDEEP 768:Y7aw4cTkXTuadoWNv4cjFFpe4MfJHwfV9zQ4T:kayeosc4MftwfnzQw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\program files\Checkpoint\Endpoint Security\Endpoint Common\bin\CP.UEPM.Console.FDE.Authentication.dll
- Size 107KB
- SHA256 ca976ee9a0d6cdcd675be0275ebc923aab7b9fcfbf13496697b00a4aaacf0306
- MD5 9880a3542619d52f415800d735a560f4
- SHA1 35f0482be8caeb0ce26be7221e20bd0924e1a4e8
- SHA512 82ecef6efa628fbc2520e1fd06532552e2ee2078b3bc138239b4663d9723bf018e39688e8990a2ed358800fa5dd6d1ef1b091fc09bc6c3aa1b012bf088edf2d0
- SSDEEP 3072:Mtorf7qpTRFBzfXGZlYvshNiqZUFOjqdzsRAvKyi:MtofmRHulqJdtW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Installer\program files\Checkpoint\Endpoint Security\Endpoint Common\bin\cppsm_tool.exe
- Size 231KB
- SHA256 23ab8c7b39afadc3bc71132dfb025afd46ebadf0926352c4eb6d5ada9ffb2ccc
- MD5 31cede632ab5a6a2c3b19f1dcda0f371
- SHA1 89686ff4605c910c98344a31fea262d536880b69
- SHA512 7e467b03dabe7bb73e2a7cc8499ef5014c7da7caa0f0cdc3f9e7b12da6edc93f32531d32a57d5a7cf5175895e3ce7edc702e7951c183f0b6c4d0e3e76d05b22b
- SSDEEP 6144:6FuT1RKnvnnCscQw9v3uwJZpOswPwZmVwD2F3:6sTTKnvnCscQyvuw882F3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 3KB
- SHA256 43934c48eefefaf1324fb6f65e914c85e7e5258bc5ec420e7bab0faad6ce5f6a
- MD5 f38c0e99e3e2470a9c3b496681b60355
- SHA1 104f363ba5b623dcc1b0c4c9d2f761341e195a2a
- SHA512 56acea04169bcdb874af32bac3a94288fc2300a189a16f454e35895cb8874e4f136cac494a826241a2a3c5a389b73e033a65da53fd32436acdb41474f79bebb6
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 3KB
- SHA256 fb075c2c877c19f7d8d027c86fa9feee66f226929bd634902252e7daf8e660f7
- MD5 9dd50b9c733d594dcede00dc650b2ab2
- SHA1 913fddd22c5b4ccc5e32e0a2bc9fa5fb96b043f3
- SHA512 20df9acece7d9941b9477fd8362b469f585a78478d076e6ab7852216fa09a25ac3e296e9e1f95fc3eab9eac8610cd72c94aaaebda294a009f2d34a3fd1887777
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 3KB
- SHA256 8ca4372587618df6452c84cc814ce05a6bd05445e7c2dedf40f023c645b53c70
- MD5 de857d031a2576ac92e8e929819f2653
- SHA1 4f4fe6b2db4f5eac008e19e3d08fe2df6a5d91e1
- SHA512 da5792e87045c2cff4a699f6b90105db6f1f19241ae93ee1959e3fb7e28a0c733fa615988df6ec9647eb18d7b21fe70ddb2dc1a98e8c4036e51a7a96b6671c64
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 3KB
- SHA256 66eafce950e6f61df20d9196d537c7e5ac6c2b17825da817bbe8e2ada654de91
- MD5 4d5cdd342e0e67b0a08e61e52ba6c5b5
- SHA1 6a9e515642ce5073ff7cd251b2716e3a51bf1de1
- SHA512 8c8fc5b6c4d20859dd7d9ab9b53acab32d237310a9eaca243345d2a6f56e5507f0823099179ce375a333e504bb33809a557e65bab45c1682976956f9f2082009
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 686B
- SHA256 a76fbe092fccc954ab6351f8eb004b6aca611339cebd04f66995b8fb9a679e0e
- MD5 fe2397f7a0760f577a1be797af40ed3b
- SHA1 580afb7a9b2d5ce28f5451b27b2a3204c3483ea9
- SHA512 244db97881c4cd0b04e87a18ba4c7fb415dcf442c9509aec02f4a1c3f4e0e14fda451ae20d9a9c9421be22091d1f540d51ebf1f972360221517e98113d91127d
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 1KB
- SHA256 732825482ab056f5713f62b3c82a499825c34741bbc9a633801467087b06e951
- MD5 85e510c42d806bf716ac26ed07eaefe4
- SHA1 b0a43e9baefa3c36b3f2c3db396c2325e0d84195
- SHA512 cbde2db4a9481c480e34d626f9eae5e073fecaea49713ded775307784c33d3e25468ade02f508e7b83a423a58e872c2f9bea12ed003319892df9573b1f8f8997
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 1KB
- SHA256 1fa654203ce26a4de1292336c908b37317c5a94648719d2a565653ae3c80772e
- MD5 fd342d2e82ed71f4518dcfe59db42873
- SHA1 eb8ce2383b2c8ffda439f861269c446968ba02f5
- SHA512 71774ae6d98c90d38eb9099822c44c7b43bce643c45557d09f17afe993c680cd4bdab72fa8662d68a424c1882dc1986117e456b269366ecbdbbc2ded1b802ecf
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 1KB
- SHA256 942d658ea8789d5fb18f9ffe89ebc924f525fc3d9c3b24457d2be7f3cef0846c
- MD5 f54e6fff8818a3e0cc1ca101d01e585c
- SHA1 c1d0701deb6c0575da51d05d429ee8b1aab1309e
- SHA512 fe80f8afc509f4567c6897f054d10d71035c893300e90a2da3086413c185c73821284550ab98b97d6b707da170a700bce21cdd954e3dbdd90c41c1234c5ff357
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 2KB
- SHA256 7b1915fc76956243c27cfd36d2092f968d36fb210298bf8d7db95587d5b29504
- MD5 5b03b4beb4f30d414211c8df37fbc970
- SHA1 1f0ef6892f9d3dca9cafbda1d7c1510cf221ad23
- SHA512 2e8716650aaa20a34b8559ab9d4114f3f6bf8c89148a3a72b9890fb97c34a04822e4d9a2a5b668f5bc75af82531ff99eed5833594d6e6d9e4bc70a5680539aeb
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 2KB
- SHA256 6d0d9a76b23b9f98730c0d7a94405594a796d380fbc1bfbbeadeb86400ff50cc
- MD5 93d39481d5137f8110a4bbc9c6f52dd9
- SHA1 3189bc705068123cda007321c19d1d5d44031acf
- SHA512 aea6d86d36f0a79e0bfbd1162447f4832ce6e743be3bec93ab309e564dcfbec2ca3a42971f797276cec32dffb4a51b0f1b51dd914afbc5c0c7e7c5d83ffb512d
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.elog
- Size 2KB
- SHA256 349f21031bf475186b0682c3b2c8237712e5835b77b896962df0c56ffd2e1a42
- MD5 10d67ab34100aced421cb5e112c2d17c
- SHA1 d0a7d47d3788b8798bb095b0e25d374de50fd18e
- SHA512 a0e9869e6980d5e4d54cae1ebdddc05d8f4a1a9318f443f0e53b03ec7a6a24de6af481e28614961fc18d9abf50e2b9d0cd1d427d1067de5c6609c9544c65e251
- MD5 SHA1 SHA512
- Path C:\ProgramData\CheckPoint\Endpoint Security\Logs\epslog.76.1.log
- Size 7KB
- SHA256 6cb652feb465f84893c08f1e350204403c2740a4d71f98c234005a5b474130bd
- MD5 73f0ed05819995a7293c33278cf124d5
- SHA1 fb7de08f6f35a537a56aa827dc17e28d2aea66a7
- SHA512 f28b107e34f393684843b68a91fd69d351ed443285e0d827c46c01f31df7db629cb31655590972683bc0dbd0116d8d5e038797bca0e724824bd0ade4d5bb45b1
- SSDEEP 96:oahs3mQhzm2JOMwhzm2JQuhzm2Jr+BhHm2JWXLShHm2JWXChhqm2uKPhtmKhlvmD:a3P/4p/+O/50/wS/w5//bJy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\CheckPoint\Logs\AntexController.log
- Size 4KB
- SHA256 14fe6063735c619063bf97cd4545dfc58d9db6726f7bca9126873e3df19c2c0d
- MD5 ce6666e913868b4fac5dba41d7072c4b
- SHA1 9b63a63084be7e05603894ef2583b34da16b4fb7
- SHA512 11b2da2aaad4d9a96c73fa0438362887ff0f1c6bcc45b663e974b5d5b145ec5662a1ad1cdfed61213b78d52f9a836bfc877a83f636511bb4ba0b01d3698d9f2d
- SSDEEP 24:KweLBHrUHrNFHrQjHrpHrVgHrjHrxHr4/HrHHrRHrJSjHrWPHr6HrNHrZgHrCHrE:deK+zSedWc7b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\50cb7ee8cf6f0fa40858be87ed8658b1_06e98980-15b5-4d19-8f6d-e648d137a418
- Size 59B
- SHA256 728352703acd3096b97675dc9960d4bd998ff87f204cc1b500702bef44d4a9aa
- MD5 08efca07ff2c227ebdd35836d05be524
- SHA1 451edaac5246096b46e8e61fa656c079b605f63b
- SHA512 2f744b12fdcb835911b54550b4649a9a712a7af47b8c0758c8068da9a8bd333a0b4f451974cc1cdeb10e8cc25bc43f963625db7438af3752ce340b4519df0bbf
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\93e219f9a7cb799d9544d11814390106_06e98980-15b5-4d19-8f6d-e648d137a418
- Size 62B
- SHA256 93087835cb3077631b9d49d0d9d8340e430c1982b4a6dc7485f26629e92096c3
- MD5 2ddd23d9c04825cde4dbe781f34cfd03
- SHA1 131834b9b44bd8b13ed369f612bf7771e7f5c6ba
- SHA512 d7db593e4b1a33421a185a3eca8a3a5502072e446fb8a430317b1dcbcf33b7b8e877520be93e3b6a4c42ef4c4901d72bc1d07fb0db2ff8c10c3925789d6c0a65
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_364712BBD9943C1C51A5744BC7D0DAD8
- Size 727B
- SHA256 46fd454d927f6c849e73aa21a43772cc8f9e34c9de5640bd4e47351d3c61be31
- MD5 05c331dd21565bf00f7a028cc8caa253
- SHA1 5a5b74153467a27256e33b8ca55a46dceb7c343c
- SHA512 fcc337d2d1e04fdccbe60c35ba6cd21f811fdc630ffb721e8917a31bd7e7e5090749c9a07b0431f0094286a2a1e8755b4b1a6fe703efefae470949a2ba9adfe8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 5777fab5a9d0fb429ab73cde719e68ce168103392305aa5af2864d904febe6ad
- MD5 07be3d60b7ed629c615e368656d1583e
- SHA1 c60121ca1b0161eb87bb1c5d6b5a415d022505b1
- SHA512 3c8d54a4c8599cc98e370033733a948cda09362337ebe00c97df158a0f5f8b6cc79de0a088bbf9308b15a38cebe51295402519d03bbd0f305c0cc8a69152c888
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_364712BBD9943C1C51A5744BC7D0DAD8
- Size 408B
- SHA256 388ff9c1b918b80af7b968cbb62ac7e473efa4e0aa4a3281b2f640c1506ab0cd
- MD5 f876d815ede87ad81fa7bfde49a17310
- SHA1 381cc927a569bacf00ff25f3c5975224d083389b
- SHA512 7c62a562caa7570824491b69cf055ab80c5d12154ea176953df618ce52ec973c8644bfc98d90bd9e17c4f3ba34af02db473e143434636fa384473335dc4cd22f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 13fe5f7e3d478075442a94df0b3dce175b37d4c62a7ff6b2cf8c5924fad48fbc
- MD5 a91f2b43dab8cfba1a4a08c5516350db
- SHA1 a395c79457c503f04f5dbce8f5fb055d3f34308c
- SHA512 81e67f8c90e322a94531c5f0fda4862113324d505e3b4af27a73455f96daa7b1c19bdaf82380fa812434db8ec3fc6ef45428d67c9534e40af8b51079c8547834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\menu\entry_point.svg
- Size 442B
- SHA256 3567939e7adefac35b1b9d1c2d53b058d73a82d5792c0da38910e1824ac9a986
- MD5 64245cb8e944f2d3d2ed035082dd0115
- SHA1 dc74659ce128566cb0a9b9951fc2155fa30b8125
- SHA512 88bbe346f792371af165420f944ed7cb3c65985b4483a7d37fd3b4b6a46f36be66b0a9bbc26079a110f16fa8e157f7d73100a919ff6fbb97d2c7b9ff1b1d9e15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\menu\overview.svg
- Size 485B
- SHA256 97a00546497ae0c36ee4a0b3259fb407b9343b77354a6e9d8d72a7a549f7be04
- MD5 7c320488eececd69331bf6d8c381c0ae
- SHA1 6477229d78fdfc3adf2576917204bf7b51c6dd59
- SHA512 c717d299252cce12b4155959550a1890c599ac01514c43227b7fb742699c501067a940800a8170fabbfcf88e0cd5be4216aa5671d7fd320291af6436c533c826
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\menu\remediation.svg
- Size 516B
- SHA256 5fb47f0cf0704918ccefc83b9f1d4eb171e7c727a22e65b7daa1f6767fdc903c
- MD5 fd1e14c6044ba8076b96466194a9299b
- SHA1 a1075d18ca4b61ab54d0f78992785de011673f88
- SHA512 e08f54cd1de87d928946aec6ce559584f24cf3a25029f7e0cf54d37e360f31016547a6e0c1858530ccef7a6a7c643f89d62b6bd8961b0789c4584d227103a321
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\menu\suspicious_activity.svg
- Size 1KB
- SHA256 06fa895265915fefc1bccad8f37fa1e85d78dfe73daf3de05bb620073da5042e
- MD5 213a8f87bda6488224dfce2a006f1a5a
- SHA1 c0cc3de043bea6c44e512faeee1717f2c50d4e72
- SHA512 c537aa9d1a6f0eb4f5f79f7278a339a5e9738cee650c841ade84e72ff0ac61778277ff4d24446f7fc74b26a7ef6dade5c36246deb949430e18006d33728a702e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\procs\cp_logo.svg
- Size 12KB
- SHA256 14881d22252151f34cba29f26d152f7298cf554ee9017a0f771d67e71e9f9240
- MD5 25ac6a8987893546a01ccb4f5b801661
- SHA1 4a2b7aa7b8b9a881e3ad60e45c5841a03dbe8614
- SHA512 66844d2365ee02c69427ab64bdd7e5aa7f910ffa5e8e84c509dc963f37aa8675ef69754755e381571b2ae6f5e29ff0a629f486eb78ee45f0080a787e8e3834b8
- SSDEEP 96:hvfaSoFJ1Ce+O2ZoxaEZ4zPF8dBt9rTUvsE56lj7d/RkaXbc5/262bcvVRbCx0q6:xaSo/8e1NmN8lFTUUn9S2bcNRGhGKCx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\procs\ie.svg
- Size 5KB
- SHA256 f0c39579d3f1b19d205db9ccb8076c063059689339bb214003db8ca0a32cef7a
- MD5 b9f43f40fc78dd1efeb934345de0cd5a
- SHA1 40bd64072f6325bb0b825b85e637185feedc6982
- SHA512 92744929461cec6f4bd20f9005c5a035475e86375414440f0846303ac45d8ffd11b56edc4b5210eb66861d49f94159688b607b1f9ffd82c3ad51e1cc3d498ad4
- SSDEEP 48:cxAvf3SJ64VlmVbjpd7gj3PaMkxvmOTaSgDlI7n1LUC3du4ZzoyT7XSKdlHVk6YM:hvfaSOk/OwJtGOEaEM3MYwyfxf/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\DBStore\Events\graph\images\procs\media.svg
- Size 7KB
- SHA256 38fdc3fbfe827a5fea4c26c7c9d446779cf8b68ee785972ebf7526cc7e7417dd
- MD5 f9cfe65e42fbff96e9553f7a5dcc8855
- SHA1 be32be3030c4e6009cfb4c28d3f74ff15388595a
- SHA512 676623b1b855c0bc4dcdee4666bf44871314df4f8cb540713b984d5346e5c344abb84f14deeb17942c37d2bd5cfc7565eaef887b1db6ae2287363565c288a4c8
- SSDEEP 48:cgAvf3SJ64VlmVbjpd7gj3PaMkxvmOTaSgDlI7n1LUC3du4ZzoyT7XSKdlHVk6Y8:yvfaSoFJ1Ce+O2ZoW0sp4s8YZPRW/t0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\EFR\ReportTemplates\abort\images\menu\attack_tree.svg
- Size 683B
- SHA256 b9c7a556eb5abe4dca21f440197d684bfb8226f390299eb5d210d5a411b33575
- MD5 de6e4b3a61778fd3456ab9a18dc248ba
- SHA1 3378296851c17cd41fbd2c40119d8afcf4b5bbeb
- SHA512 db436339c66e89ba6cbda3df72302f837a5f1b3374001447f93ce1da209d81d6d90c1592c70875db581c45a1e6ba9c67e11202266d0f7dff5ce2c350789ae5fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\EFR\ReportTemplates\abort\images\menu\general.svg
- Size 1KB
- SHA256 b505e0d348cae6b974d7703910c9b2a610d53288822a015332cc4eb9ba123bd2
- MD5 aca1d1ea891c806a8e70e8e0497697b0
- SHA1 69254a0d87c779bd643cac86c3a084e0b878964a
- SHA512 54fd87af3cefd4674f416575671121b1009f1eb0563756c7d88e34e793d28bf2a26dca680268cf6c4d237fa74be416d4a2a2165adda9519fbf4eb940da1cb20c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\EFR\ReportTemplates\fails\images\menu\business_impact.svg
- Size 1KB
- SHA256 7b47036780f242339165a8e97b517677f5bc273b76442f567fb2816ee03c577e
- MD5 9c9078d01cb1c554d716f63d2038358e
- SHA1 0d03aca95e138bb91ceb8c78376934a58830e1d3
- SHA512 708038685eabd5cbf5795ec39139bd64a3297670a7582a82f5587052b06f9aecc5e92c17e56bf940bc9160de8855157e1d2d2ad9435afbdd5a6bb0836e86054b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\NetFilterDriver\NetFilterDriver._32\WdfCoinstaller01011.dll
- Size 1.6MB
- SHA256 c7649879a10c9332fc0f9744c7e3224647aee9e7e62c7e21cf9e987462e3dd06
- MD5 3d2a2d921135801835073451f002480f
- SHA1 dee0ddc820cd0da546dff8bcf2bc490326da90a2
- SHA512 addbe5095430cee8f2a4c25440a9e924520a8eaacc09dcf42b0b2fe7b4930d1f5333bce585c58e7d14ff82c7f9a0dd204b74fef508b96063c181f78382b98aac
- SSDEEP 49152:ZYedhr1GtpoBkCX5onn5BIFpumu5Oo0hSx8fokJV:xPrMoCCXG5+M5O7hbL7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\NetFilterDriver\NetFilterDriver._64\WdfCoinstaller01011.dll
- Size 1.3MB
- SHA256 b8efa154560b8310aafa8d4c0a741cead7f6fa50a8ae7c748979d0772aae4d0a
- MD5 ceee099d1592d840ff082bc60be99d4a
- SHA1 0ff3956c5387cef30ee90119d8d70a076519f42d
- SHA512 5f4451aedfeb58956aa4c63a460a6ae24f71bce885d4c3c35e388e9b8bc813dc21b6b2b4f38b0fa0a134574e592885847d28c844db99ce41e3b2484ddb4d2043
- SSDEEP 24576:QOU2REnMA07r6u1ChQSTqIRu8h1hp8nPZtnW/11Xkv2zAjB3H/8fnEJaxXcNrRq2:jRUp077GQSph1DxQOzAFXEfEacq2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\TPCommon\EPNetUtils.dll
- Size 287KB
- SHA256 f2ff6118ff9afcd11f572e5a1166798e48623060e1bd1d802ce526718442e369
- MD5 ae30d85f493629b8d9765b6820102750
- SHA1 7c62d072c6f7c3101b709a016efb2fb840788fcf
- SHA512 93966736827bc51facec0a163dab2e505148c20f80f60326cb2a451ad43f7050b06d51318d156a20ce2534386dda0e3767ca3a6e1b4ee39959cdb78c980b79b0
- SSDEEP 6144:cW/BRYfjUb6wfA6dcxtb8o+4SYrkeybkoY89269Zwa8DtZCgLL6i:3ZSwo+NYIeolv0VtkgLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\TPCommon\Updater\Replace\EPNetUpdaterIPC.dll
- Size 29KB
- SHA256 61c79a5d2823efb0e74efbeab89e8640fe0eb7fabdfb4e8084fd0761d2aef44b
- MD5 1f58b372063cdccec38630d51be5dbe2
- SHA1 568c06ecb21f5aa1c415746ad573c82f13b19bfe
- SHA512 909aaa2ead56da0298f292bc376b8e5f10226ec3068917ae467615c535d7633709d859a2c07b5b8a3231bea24d37b7b0008d90118241259101a8e931b4cc7211
- SSDEEP 768:w4mH7epWB5zR50UCn9FzkH5IOYifiRBEZ3:LW/zr0UCn9FQH5IO7fiDA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\TPCommon\Updater\Updater\AssemblyResolver.dll
- Size 17KB
- SHA256 91bac94bd516b8258449455177f8d5b7df9b0c5691f9456616b113a6a27b67ed
- MD5 237e7d5a1ebea26536f4ae5367a795f0
- SHA1 52347ff411d56f8f029fed6d30961d0c087045b6
- SHA512 36325902dcdcd69dc9e96ebf75916353c2b32aa7366fdafe894b4b8aee582f09d580c266832c9cf5cc5dc2479967d76d20e021bbff6de27e0df10f389208997a
- SSDEEP 384:6/sZv6FZqGJfl+R/ocMza5ZL585IYif8ZpH3GCJEGciY4m:SJFaR/ocMqZL58uYifiRBE6Y4m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\UIFramework\Bin\CommonDLLs\log4net.dll
- Size 264KB
- SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
- MD5 27fe8d18682fd9901e589e65ef429b23
- SHA1 6426e96243911beab547f2bc98a252a26692f11f
- SHA512 9d6bc8c77c72cbad15e808281818c2768f1b44aa6ea1d54a979c91218b8fbf2a02fee49fa97db6cfa6087ddc363d6cdd6407e4494934b4568c514437030a2615
- SSDEEP 3072:HG0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCj:HJrycoB3HVeESME3pnaVTS1nh7hCa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\CheckPoint\Endpoint Security\UIFramework\Help\ru\Endpoint_Security.chm
- Size 225KB
- SHA256 29ccac46021e84ad4557c8cdee617129b1ec77e29d187d675eaf88d781b9f07a
- MD5 fae9a6e663e482ae87ca19d92b99d11c
- SHA1 9fcd7bc94fcbd91bd094e71616d26b3eef19704d
- SHA512 f58cc39cdcc5db5258d1420c6c5a3dcf029bd7b96b7f71f8e54a23903ee2a119fec5ce0ecf24a0e518c214abc29b7f8c697927fe46e775059db925bf2770e3ea
- SSDEEP 6144:tDJDkht/xWU4bP8LU0ao2/h4eW9BwtXxhjN9mOPeJc6epc5rj19:zkD/xibCG5RWbW59jPeW5pc5rj19
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\ComplianceData\WindowsPatchData.zip
- Size 1024KB
- SHA256 be6303f836a25cacab4d696ac5b61814e0fa51b11c94fab3af01370a61cee201
- MD5 16e2017915f18f411968092c2e5dcf17
- SHA1 0cabf407ba98d0e85459f0f27d72ae56fbe091bb
- SHA512 37eaef05766e2ea4a141995eaed8b2bdb8b78edccd8eb4afc43fd450d77b1746e40d44c008fac177dfea37a4e3caa3ad960fedcce4ee1998d7b2bbacbe89ef2f
- SSDEEP 24576:y+CK/PuewFYFeAobqlqn30l6Xt7PVg9GUcvwJm7:uK/PYFhAob9XPVgQPwJS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\ComplianceData\partner.manifest.xml
- Size 17KB
- SHA256 a05673daac9f5f50978a5f9eee70b26f74fa7025842e8dc009d7c6b77b3a7986
- MD5 e02674f20ca540a8800e6092f45ef152
- SHA1 13e950b2863c220ecc976a544be6f57c18038e52
- SHA512 7eecf8f8f760043d663215b37a9eeba63482b2dc021ae0bf447c72968c6a161f73fdfe9f365408a14dcb9ace42d27e42ba4ffaedae475d3956dd6b5003c97f86
- SSDEEP 384:CUvqDMWp/mL+U1mk6DBLqFH7ctYRGbR2QuT0VPM7Yujo308g:/i1uz1GBmdQBUQY060j3Ng
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\Config\DefaultPolicies.exe
- Size 27KB
- SHA256 fb231d5624a910fdc15652981d5004b606c739577d22f411679efdf8861b4302
- MD5 a463e17443af8fcec015030ac5543a52
- SHA1 a91c87817e7d4502b95cd3ec1b338c8b8858405b
- SHA512 305a823a02bdf4ddfe9f4029364be2602a1506f06743ceef8cd0d4913d6db9750c8d01d7d6c0a2e621ac65419114016f25ad6fefac31d524a980f6abbd1cf802
- SSDEEP 768:kTp5McH4kK4TTgUbBHErgfEGbsGm5o55jkm+9gQ:MCcHzDT0Ub+rgfrv5xkm+j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\Config\Trac.config
- Size 396B
- SHA256 ab03886400a5052068397b352aff5a06e12b8a4c5cd37470d1268a6d9039b18d
- MD5 9c41c873ba73107441be9577d57e6883
- SHA1 96472c45e7f713344f634a3427aeb3066da9e06d
- SHA512 3cf12ebab7cb36cdb0542c07f489caa13624137f8f92af65e892f62d87cea19bfd9493c22ccbed5cde6a747e646c17fff292ef9d8a4e175b1376c2a7eb27cb86
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\Config\config.dat
- Size 14KB
- SHA256 96713223bbcd7df558181f213bd9ed94b8fa9d1d6884ca362c777df23a043fa4
- MD5 665341a40a659399cb845b90246a8f75
- SHA1 f64330d153e24151d87008e7e31f3618acd3566a
- SHA512 09ff584c3e399dc62ec5e0ce7099093829014ae5902b3630147cdf318ebbb7ec1490635623ed185bb72635d89e96bf1397235e3c1763fa895dbdfb30cecd5b91
- SSDEEP 384:cltszpyZuLtKOpKwNHU0QjMqLyEuKIgMmUHW+Or:/yZIjNHjdeP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\EPS.msi
- Size 742KB
- SHA256 7a71c3e21dadd884c82343017e0b5057f51fd2c844a58c9504d752ec111322eb
- MD5 6103892218c8c2b17f9051a38cf8d3b3
- SHA1 492a0520a43873b40a46f49c899230752cc194bf
- SHA512 c4c0089ee8c3e66b1004836af7af202c5b43c452abd887b2053b7c75631a726acfa1f971919ce34ac4104af220dffb4f9ae9b5be0ac172329198b605c58c087f
- SSDEEP 12288:hFc1VTgICJ/Du8H45WORTpuse7gbKknxBh1P6P68hOUAxbsh4r:hFc1+R/D44ux31yy8hn2Ah4r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\MSISelector.exe
- Size 140KB
- SHA256 9f75eab34c51bbc3f61c0ab102e5a6bad673cd9ca9b48e884f50469e60a8383c
- MD5 1728a00bfa296fa45c203f6c0cd14f93
- SHA1 65df5ddd142c5396c1ec9ccb0ab8b84490c2b0c3
- SHA512 9005da79fffa93fa3c789b954eb6680d954b1879ef8c5bf0d4c01864d35a6bb6c6bf8680ca998add6194722dbbb0c3f3836a046e750132a51086445fd38bec64
- SSDEEP 3072:NNSaw8Ea20SpZ37M0iAOPxzHXX5bofSXxqVpq6lwYEwgCuYnlXNv2:NNSahcT37l8PdXBWBl4YlX0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\Nested\EP_VCRedist32.msi
- Size 12.5MB
- SHA256 1845183b6c31e18a27e33b6efd96978d2cf5bbc9545add8eadbd871518d7bd5d
- MD5 703f8f20870a6294b515deb41fce65f7
- SHA1 9d28e072ee730f7035dcfbed84df18d19947f363
- SHA512 f58a112adfbfb615f70dd11630e29f6ba5bd7e7dbf06c783e7b8d87386731a07f96a32d3647971c2bce805762042803a3ff77c982a76dfe1d09d81aa7593282a
- SSDEEP 393216:GDHo1tfGo++dbmzNmgHN7HVwsY86iTic+l:sUtfGozbmzIgHxHesx9i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\Nested\EP_VCRedist64.msi
- Size 3.3MB
- SHA256 c87ad67dc9fae717ce04415d06c2232ea379b4b787064c09a4091e59935ec641
- MD5 1d49fb338c8610dcee13f8c40dfb789c
- SHA1 ffc708012b380f396725206f300354f32b05e8c3
- SHA512 8556e20ccc80217e351cb4d4d4abc84cf92a2e7c7fa5baeb6492d85c7e0099f4242cf19db68aa51bded705a6264552285a937e71b2dc4d1603ad5d1a55715e92
- SSDEEP 49152:K+D2DYmKzGZdqokrp3JfybaG+EQSyGOfN+NicA2/ulNf44pWbrpo:K+M2Gdq7w0EQrz6icTuTarp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\program files\Checkpoint\Endpoint Security\SandBlast\_locales\nb\messages.json
- Size 12KB
- SHA256 42d4a9b525f31bb267cc9d9b72abfe898571c00bc8b2a7b8e12ad70f6d246526
- MD5 1f09eabd10e5b26b41bf61bef5d873e1
- SHA1 fd0a42296f9fa27a0a22cb78311cfb7092e3b8b5
- SHA512 b19f988b15febf60aa16e040662158d4310aa14f16867addb6889b0c599ea03f276c7f76f54f757c37f2465c3fa2ac6a4d0a0e072a429d959a1cb7c6a8eb6d3e
- SSDEEP 192:BbylgMyyOrbhcEDrZzPMj9sIj7m16y+FjOTiTZFFIbCFsj4YdXFP6s6+g7O4QzDQ:Vmw/eAus41nLlw4hwLSEX8PPg04V/JtG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7zS48BD4397\program files\Checkpoint\Endpoint Security\SandBlast\data\cloud_auth.js
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI8b9a6.LOG
- Size 2KB
- SHA256 a74c3b3216d0ac4179333e5ff3e55ef18759dde5bfe87e95d59d4ab8faa018e6
- MD5 341495a142d12e13043ed1a8c27a28c4
- SHA1 daa810b3d7657a4ca740dcdac6a20e4da1d77b59
- SHA512 c9d363cdc96ae65e00a7b498b668db502549cf471f876f9591db4c7e3d955dc47d49dd9529cfb3e50a72910969a0e41cd7f236766304c49ff26af37473220c7d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\InstHelper.exe
- Size 640KB
- SHA256 c0b460d1e0446be5d3cdeb73ff5518879b9ff66a73cf61197b426f35079d1b94
- MD5 13999e3949df7ae6e889ed0f036f0311
- SHA1 f767b5ea6ccda4de3ecf11ea3b7ff4658050949e
- SHA512 fae49f1231f0c06659831b4ea30e946678118c9b7349b594434ceee4f8faf10541a0d37cd118e5a91a742f35885b4207d00ac5ba65391409b16afca532593ae0
- SSDEEP 12288:S8Obkav3rQEQiVCvR5FNZTbjEbDKrjp7yFM5:Dk3rQ5iVYR5FzbIbDKlj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\InstHelper.exe
- Size 576KB
- SHA256 e540e144977cc1712ec6468958731398b99a10a57a23736bfb04a8fb2d4f572b
- MD5 d9f55d14809e8510146685627c4b8f1f
- SHA1 93ec26d73348f159ca3f625faefdb26631437953
- SHA512 ec87aead46cdd103704d586159dfb2e5a43e54a86f54dd837fcad0efc512aa354c49a084de96f499f838af230f855b0d058edb761ddf31fec78c3fd8016a63c5
- SSDEEP 6144:S8UJbQRRiHBOP+3PQ8ROEQiVCvR5FjxSZS5Bp/rJ6vUXv4zObjsQWpV1bv:S8Obkav3rQEQiVCvR5FNZTbjEbv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\VSINIT.dll
- Size 576KB
- SHA256 46f1731eab8b80c39df8c764a36eba0eff85d1dbaf9de9fe33a9ab0c32f33b1f
- MD5 e5ee4c5f0521271f2232018f7e33bef6
- SHA1 679daa95f1b779264c58cb8f555cf07992818089
- SHA512 d28d9d43f2a4a5a10fd502dd1801d1b53e9dbfdbafecb08b1211d4f84a19daef00c257dc6d9a5ec2153673579dc38e60dcc2476a8e797b7edfe71e26c25b13d2
- SSDEEP 12288:l1GXyzt6N69boVbDqhP8tRggRIuieL9UMFshMCkE:3vzt6N69boVbDqlug8keDshMCkE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\ZDx.dll
- Size 138KB
- SHA256 593247fa1f43b45c55fa2dacdab6d8f5b44e69e08f57157127551ecf05a25486
- MD5 f9d2517fb04f1d31dcf9bf0c8795872f
- SHA1 df00593a789c2c864bc9583e55448b6290ad7a21
- SHA512 01f34dde33254711e7b6fdb8aa4d99df4720305ba763c2492ccdd62a8f8c48b1f7653c0d3d714450ef5532f14daad8c851a3fb73d4457792fb587fe95f5cbf02
- SSDEEP 3072:NwcqOYrtvASCxqg+/HwemxCZa3MBFemww/mfYZ:7YrG2/HwpCZUMBTe4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cpmsi_tool.exe
- Size 268KB
- SHA256 95b81ae6fa72e41c1e1e2aadd6c5ed004a02bd90e9b0154bda7516b981756f84
- MD5 1cf044ad3734a695e0e20ab6c4bbb7ac
- SHA1 6c1181e2c009c609e0c077e3f1aa6f7db03f4bad
- SHA512 1d59f52d0334b89624757b85763606d4f4bde288594d41d4f32b83e9cec8b3dd991b0eaeda04c52bfc672ff048c6ddd52d1d6c68eec4c2e900c02377ea349085
- SSDEEP 3072:gSd9ttFT5gF0WwiA4NeF6RzqC06PHnBWOwM2u53LDyQHK1v2FxIxJDCAbcmfEcT2:Pd9/FT5Uwl4N80zsEHHwczFWCI8ci
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\cryptocore.dll
- Size 289KB
- SHA256 e196176cf6e93584e5a0b07785c9ea2cd13ac8467ffd294cefb579d3533b462c
- MD5 57fdeb51c5e1d3b3b520d21fbd727354
- SHA1 6ecdddefc2e7a2f38493dd0466bb0adecdd79a22
- SHA512 49b8ef5a4812afdecfc82d01ce3ad56ba21a4cc00d454aa1657530612082ad1e8b4db0b9ed96a9af3d04d1d1060b7184990529cabe62ffb625709b4c41dd89a2
- SSDEEP 6144:Eq58Q6ObGa3X5FmMVM3/3qqDGovIF9bMcQ:Z58Q6ObZ3rVM/aqSogAcQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B8F2CD39-7AF4-4F1B-AFD7-00B69E15C098}\vsinit.dll
- Size 512KB
- SHA256 39bc6212ffb8a746148048079e831e49b169ec30b0812582030f35804a39c033
- MD5 34860c4b92753d87643c59c8c3260606
- SHA1 bf3aa16223bae879d01ebcdf2d0e9f84323d9cb4
- SHA512 20391327f2eb85dc965eccc238c009dddaf66a2079369974facffd81972e1082f65d7214c6314bdf9f9620664c9d630e1c5f4a6de106cde98c3f7624e1b4bb3c
- SSDEEP 6144:l1GXEvzt6uQCa3Gl9xGKoVbD94hTEC2KPMK2tRHxvagx9RIzuJ:l1GXyzt6N69boVbDqhP8tRggRIuJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI2447.tmp
- Size 1.6MB
- SHA256 4ce5d6d83e92ea1fdb40e6473a6ff30dc7964d998dbe4952e20318c800ae587c
- MD5 a0868a6f2e228d27bb8ed6a69f50573b
- SHA1 37bc5331005abe20dccd9de8d84543baac0955a7
- SHA512 c0d516d73d6f5e03616a3e543e3a81c8a0dca0d68f5941a4e728c6ee71cd428b569065bef6bd5811744fbecd9d9805c4be4eafa17b98a14a862496b598213f70
- SSDEEP 49152:7FNl2Q3lxTwOaKnlQXT6/MpYeQNHcLOQDb+LJk6WiCt4MZWu34TY:7FDLTwTL4NHcLAXW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI25FE.tmp
- Size 57KB
- SHA256 e886026008391aec859db251fff4c9a55a45c50c227e4063d336835073f25745
- MD5 e514c184fd59569180f9e29648481f64
- SHA1 5d2d29c996974d88ab7ac1db76581c79c77cd3be
- SHA512 9f2c1fba7c25c743cc4c7129956db96237d78346d9eff2923b542cb5d692a029046ad1528c70e20a6f86747f74f6a81d6308413fbc4e82a3fed1e941603c9c5c
- SSDEEP 768:50J8+QCTqaHxKkUmrVSarTJym3OZESrctFKjSL5bCC1/:VCTq2ttpDJT+lcGSVCU/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI362B.tmp
- Size 217KB
- SHA256 3bac9baff52ca46a14e0153a44d623a01faed15e2b38a98caa5012ad168efad0
- MD5 3add3dd4c56dd060be6e883ad0de2061
- SHA1 e3ff0637a89a85668bac5ff9b382679add5c8d0e
- SHA512 bd014a679d539344228af7e3d218621e4a33ba1483d0da2a12ce01db3d6f5fa0e3b748d13aac2d34e1dd31e6975492cc8a92f80a696bb7b6c1be639a10826ae8
- SSDEEP 3072:FcScqVx6P36pJujUy9UKvUqxYOzs9Fs7vEd5wbT0l60b+UNeYD+FtSPLOZ9WzrWU:Feg3MlZGea62OPpGp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI369A.tmp
- Size 628KB
- SHA256 a9ce4d8bb7ba4d1d2957d12e8af930b83f4c7134faa31ad672abed5c8a5e98cd
- MD5 49e0d842b0c28beb66cc58f134cf6b12
- SHA1 cec7144512c05ae245f72b07ab5b7a695ecf890e
- SHA512 a913bccbbc0a46e209ed3cd630aa34b9bc6fa79a73a5c513f845f54c7eefbfee00b1805755d8b71ecbf1ad169f22944540124f7cd7a00684a9acb5af204b0fe9
- SSDEEP 12288:HzPTQgqeLwdr5W7rguBzgWTSSK7qZAYFE:HDTQgqeM5W7rgYzgTzGZAYFE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI39F8.tmp
- Size 165KB
- SHA256 8ee2d65c451e018633df451ab3e9640f5f95d7bd12ea9ed504835f8dd5a04f99
- MD5 031100733b19f00613594cb23a681ff5
- SHA1 9a2d11f8fec5693b02e90a59da5d622898754286
- SHA512 8d7d6a39e41376d3820c6024a5e5caf22f1418e124836076c935b66f9e8440b7068dd2a5217b07e33af7f7761933000799d0193720b77c0137d6ebfe2d9bdade
- SSDEEP 3072:kdrnK0It2OsmJcZnD3nLuZ8o+A/J3uoD/Cdn6qCEvvU:kdrnK0+2TxjLwD+8J3f/V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI3A38.tmp
- Size 5KB
- SHA256 b87088d5f66efaa52dc39b7f24c387f7f003e68ae4d5cb4fb023b8e2aca191f6
- MD5 c2abe0e197f338673f0bdbb0f2721912
- SHA1 9df32f0735962f43473ac55f28c88d3e4b66afbc
- SHA512 c35d809ba658dc7a5667a1ed615cac199dc8a6c838d66d2e8c322a024cb72deca8d0a66c0108287e3f286b883c00a6cc1b9862ecc6ff9309f59d7c72a74a980f
- SSDEEP 96:3d/ha7nr4BOK9so9MKneqx/WszeQO7Q9Gdj/tDOmQius42kWvGSSb+bdg:e7wOKxnJOgeQOc9G9hhQiudaeK+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI4C0.tmp
- Size 259KB
- SHA256 84756d6e87c51c9a6419ea99f9be9489dde0a69f5c1774543711c42ab73eae1a
- MD5 fdb29a36acfebf657a564d6a03aeb8a6
- SHA1 0522e6a436747dc3f1b1289d665312efa6f76fe8
- SHA512 f161ca7b68912504d753889f6639ccbb97fc21c9795ef8519ecf3e6b5136d5b3a1a8bf078c1e59ebc5c8ff770715a9a11c1a01276156c88ea42d7d0e6f73302a
- SSDEEP 6144:ewJg1lXOrHdAPazwV8u08+3AOQLmYwlbH4gn:7JQMdAPa3uilbHJn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI581C.tmp
- Size 630KB
- SHA256 c461ecf65b40ee956997dcc27f626dc1496ee7df30ae7351a2e6838671fd3607
- MD5 ddac6f3ed2982e897cdcbf401678e045
- SHA1 0192b466cbd19a33b683ef15cd881fb401de3a5c
- SHA512 f1330dbd22f6ec13bc978c1ce12d69bc413aaf4f877b2f50f24dbfb3722c93cea3a5db1012ad8b9a379604a2ca76a6bc8fe19e05cb0d8c576e0d9cc8a110640d
- SSDEEP 12288:17vJCWcH8Exq/8X/0ehQTXKoMDgGzzB7hYnZ+L:pwWcH8EJX/0eh8jegGXJL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6BEA.tmp
- Size 2.1MB
- SHA256 12c8d747d2f9f3c40354d8abff9808ce1e6e1bf772b8a6fecdd7e6a3bb144684
- MD5 b5550fda8839884d1cff705cdb34a50d
- SHA1 3294c7453ad3eb3a404801e777ea08a41470f660
- SHA512 e115231ded482d78a59642bf68d4aef5a30f43517bb920f0e28524649f09c8dd1fb460c12da791ea458da5c979d9ded334d1816759528f8b73961837b5c4344f
- SSDEEP 49152:th2y3TCd68so+xpenh9O82u5BkmTzlOPy7NrzTRWj+XjMrK/xN2/Ya:thXDh8sNmnh9d2u5Cmlb7Nr2+XK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6F79.tmp
- Size 1.5MB
- SHA256 da532956e218d50a1ce914cab856d7bcd593de0a124c2d16618b190c627009ab
- MD5 ce9d8f6af28efeee76bb207e0e14bff1
- SHA1 57c0b6f1ee726413a7b328d831749380dee06ba6
- SHA512 cf722a3ba113f7dd612994170de9eb839c49dae91605d21200d649a0a10b9f85927c8298ca594985ce6e07757eb1c186b8ad64c84084b7f42bae09e7f502619e
- SSDEEP 24576:cQFNlzSQ3lI0lTk5+zaKnlTTNSc2/XXT68o1f/8pYeQNHcL5AehZDb+LvJk6WiC+:7FNl2Q3lxTwOaKnlQXT6/MpYeQNHcLOb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6F79.tmp
- Size 1.1MB
- SHA256 6d1c808174b26f37bd8ddcabf542f16fc9b832ea8212f0e19e10504121850bf9
- MD5 3b7937ed944a5b51b9a5486830e84a2c
- SHA1 0131b9a51faf8de536ecc2f0c6a30e24414adcdb
- SHA512 f44c8c459cfa72bea99af316431eb5f70cb2f1ab2377d213c48ae3697dce15fee3aefc4ffddbe07643d57d70630ff0855496e4bfd02cc3cc3cb3a091a24a6080
- SSDEEP 24576:cQFNlzSQ3lI0lTk5+zaKnlTTNSc2/XXT68o1f/8pYeQNHcL5AehZDb+L7:7FNl2Q3lxTwOaKnlQXT6/MpYeQNHcLOP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6FE7.tmp
- Size 1024KB
- SHA256 3961c3b9e63a4a9568e03b5ce20bae2c0f8551ff4e11f3990a3149898fe224f2
- MD5 50f98fdaca51743957734d87b4cdbd0f
- SHA1 0da57c5098a0996135da687ce75dc0e632e47c68
- SHA512 0cba8bf5e29f99f8af7796b39e5959bcd53a9c2ed29758a99d481f2a6f04d5bc2a864c285302c3a9866224d1a49825d3edc1e57195b941c3a31303be116fb8b9
- SSDEEP 24576:cQFNlzSQ3lI0lTk5+zaKnlTTNSc2/XXT68o1f/8pYeQNHcL5AM:7FNl2Q3lxTwOaKnlQXT6/MpYeQNHcLOM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI6FE7.tmp
- Size 960KB
- SHA256 9119898a96a8e9c667ce7e5f6b0d8acfd23f213f868250edf0ab85f888d38553
- MD5 a249cf428eb33e7ae8a1e384c9ef5a28
- SHA1 97e13c9d111b86cefd2477219f470a13bceef9a2
- SHA512 5ea24abfa48f82f315edae3cd6b99985d078174eee6c5a298e501af06e6c5db5f21fbc1f3087f0357c221877bb5c2f7c35d3a17f4d79ff6927493fb83ae4ae07
- SSDEEP 24576:cQFNlzSQ3lI0lTk5+zaKnlTTNSc2/XXT68o1f/8pYeQNHcLS:7FNl2Q3lxTwOaKnlQXT6/MpYeQNHcLS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7F2C.tmp
- Size 441KB
- SHA256 083c7f5e7ae4361413824720432f5e26b42b46b485fcf19d9820bd315ec1ea4e
- MD5 baf1fb402785ff220508ab738c08f17a
- SHA1 bbccdd8f4dd7dbb26c5ee95fd9c93c4575334235
- SHA512 5273d39af52ab7fadea386e743a194f818791f69ede67b43e13d50d195fb49e6cf7ff2ee5e1c59b320a8b35ed71f61ace8d6eb2fbf839a603287964b228a83a9
- SSDEEP 12288:NVIgXDpxY8R8KfcmB83RvKGSaTXCNBCLU:NyYTY8RGbTXCNBCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI81ED.tmp
- Size 85KB
- SHA256 38ea6b03c1fec262d64092e4e645f7eba69dd6b5d189669520bb520cba149928
- MD5 a9c0bc167ae7ac8e7877e7b72de83d7c
- SHA1 2c4188ce1ec588aaf7e52448317f532b9a1f9284
- SHA512 fe7319a4e93f5adb36bc265150a33a30f7adb9195c5b61c6b4880a9d6976ea95e31d0947dd79cc987383a01282fd9332c349d5e9b273f43b2cc0e09e259fa4bd
- SSDEEP 1536:YGVc9hCF15+73lRS012qtc8+cqXdlCPfUlnQ1i5UnH7niN57tA:YGUCF1U3lRpZcGWTT5UnH7ivxA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e592169.msi
- Size 24.9MB
- SHA256 dc5f8e469572b530d01697f20e720e90291cccf6d689ca3235519fe01daf39ff
- MD5 8976e3b2e696bb932cd1fd337016a7c9
- SHA1 43cb44c1edf93d7e592ad5102b085690a294d0a6
- SHA512 6cde84d2044f70e80af7654e9dddc1ee0b173f3989db954e80204cc0aafd5d099c6d09af07ab0c5353fbbdfedfab999c703e83e61b437f2545a3198fea43575d
- SSDEEP 393216:EOJY6f5xhywevz+NVhTgLjz+yO+UtVcJA4Ykod:EsKrqVh5+UtVc/sd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\BladeFoundation.dll
- Size 2.7MB
- SHA256 750b0e14558ff4081c0bad23bec1857fcfbc1defc6e467a84d981366f36f0ec1
- MD5 8c70f8d62864007554976d8bfd1ea7d4
- SHA1 911241a8ea713924f41ce5ae3e24fae02f8a5c0c
- SHA512 df5e0f07432ea41c819a22939dc535adc79bddd135084ba0c7317d423a8e6eb4a2366321f6cb56f248242242217d0e41cfe9eb9ed8a03b3444a9edf2ac988aa9
- SSDEEP 49152:51gg58ZlYu8T0r0XBH+o48tkC7lzZy6KuuSs3XRF5V4siWV:IuT6GBtRt17loB5T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Epilogue_spdlog.dll
- Size 833KB
- SHA256 a77efc801887a45a3a946ba90eabfbaac893d30d74e4872c096cf3c49bdf7667
- MD5 f6d06cf5536b0655f83cce533456596d
- SHA1 e6b61ef50937049bd989d88bb38582c9a48a162c
- SHA512 038adb150a5073a185cbdcca90e63aebb692011304612737355718445552e4e89809c79ea858c1defad001fb738dee38264f353f6aec97205b6b24e6c869bcd1
- SSDEEP 24576:Sqhoudyvm6MRK8spRWT2ZlbJNP7ZlAu+6qe4De:SMoBxlV+PDe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zonelabs\vsconfig.xml
- Size 492KB
- SHA256 67ee69a407508e6590a3030798c36e0642b43e637fad8486025d70c055af2312
- MD5 6bb2f96dddd88a84db9bf0bfa51dbe0e
- SHA1 4f7684e11a2aa174dbb996d817a4f858e0844136
- SHA512 8d6f56186e7cfd1d436eae75b24522625c3184b26b9695ba6e94cfd74ebc7e060bf7dd8ecb91b1e8530312a40ee5b14af0cb6cebb7170037cb4467e7c72f2aba
- SSDEEP 768:xvdzHZ48N9gXEY2aiHPJqD0rcyCiroUPdY+UN6Rl7zCsPCMKUNgLekPgPpobyGCs:H9gX+aysEcCUNMPpcxUFL55lsb2KaCCe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vsinit.dll
- Size 1.7MB
- SHA256 5e8b448e2193f571198a1967bcdee83ee81618252b79661e1026ea27493a56f8
- MD5 b7737e534589a65b607434813197739d
- SHA1 5845c518b36b668eb1fe919ce2f5a4a7f1751bcb
- SHA512 1c211fdd3e6ba6e435a8f5f5b09cbb9c1e64a44a183267346614a4e3eb59ad4805370cd9c7b628ede1bd4702731c73d456ffe6911906144dd70e1b7a78637c39
- SSDEEP 49152:7jGbbpfSkhtXenof77XBrFU0cnnxTlaAGNQlp:7jGtSkhtXenof7FFFcnCNm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{5d0a7755-98e2-6f4c-9a0d-cee65ad47512}\SETF95A.tmp
- Size 10KB
- SHA256 6e8c0cbfe7cb1be818b4095dbbafd4fba04db9b02f4fe592c20afb80934d6388
- MD5 f4fdf35de0ef11a52410be44e9f035ec
- SHA1 c67019f44b1c886ab57c0ca3528c768aa1fa2401
- SHA512 19a3d9b9c36e1c1b5dd5a9c7d4cd9a51674e4a56fabd14496589f86a55543cf292e2762cc1780ea1ad6902def9fb0556a7e39074b40dcf528ca2aaee8f01bebc
- SSDEEP 192:vAKXyBJCSEIPWkjyKDUFWQFooUks9gICQX01k9z3AFN2q:YpPWRFRFU/P/R9zol
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{5d0a7755-98e2-6f4c-9a0d-cee65ad47512}\SETF95C.tmp
- Size 74KB
- SHA256 e1089ec93d636938186c936f9f28f360ef40ff33862e741da002317dbec4cfab
- MD5 7ba5dec4c51df260bfe3129483167489
- SHA1 8ebf1331fdb3462bee54f77faec374697d5cedb9
- SHA512 ea7bc40aefe4a6e8c4181b5d2c29b72d8f598b0cde2725849ed4528e783e245ce9b6d0856904403f7adbbe79b8e8901d4c21fd50dc9ad387c762a5ffb153e5ea
- SSDEEP 1536:TgV/+nab3+LWQtHAXcBjP1lPpmf9tvgm7nYeGE5+zutC/:bab3+LWQAXcBP1/o9tvgmDYe5Md/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C51.tmp
- Size 11KB
- SHA256 c1ec6c6a50ee08bee1c873f307c7b21f9b5607ae83ede5d6730e1f890c38b720
- MD5 9d5bfa2df1f4c8523d2529a3fce3a7d6
- SHA1 1befec752393582292e4866df5b4aad5ca912432
- SHA512 108e331edf31964fad1537626ee5541c7c6e4b04c31b79d916a0306b1f83f0741704d417d34fcaaf66738eaf0cd9c5c7aec6ad22b3497043075340619086c204
- SSDEEP 192:L0WDvySJCSEkF3Ee2yKO3FWQF/8ngqtVVwX01k9z3AdYScMX0nLq:T9b3FRdeVwR9ziYSHk+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C52.tmp
- Size 3KB
- SHA256 567dd3ae9d3bf3e84a20f0e435c88eea7fd1b7860664eea2050b23997ecfc395
- MD5 35382a77f02fdb42aaa6317d3d942008
- SHA1 f7feacd51031bfded778b46352738ee2ab302968
- SHA512 1710aed43456ce31dad1b4d44984156a13aeccd3cf0ad48f14d6ac4760b748cf69075206bb0ce73efe0b5adc767bc9e3f531431881c85c19a7df36dbbdae9e36
- MD5 SHA1 SHA512
- Path C:\Windows\System32\DriverStore\Temp\{959e14de-f3ac-fe4e-8215-d42bff36b693}\SET2C63.tmp
- Size 656KB
- SHA256 48a3d60afa58734dd64c4f07ac630cb8d7b15735e104cbfdc760d3f1f4e40134
- MD5 27e4f1cf98b6068170996a1e70b33e0e
- SHA1 154dbab94a23aa73499024547b1588937fb9cbc1
- SHA512 cf02f801bcde1d99181f23318a186c36ee74f099c24f1b6fcd81edb16944c1b6f5a73e5635f7bc3e4cdeebf7db66ef8d0a9de1dbae7fa9967029a8bd3be721e6
- SSDEEP 12288:CWqKT69lhazhisQzLIZ3KznW/NiAN0E3eH:tq869DchirPM4nWLNg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\SET4F3.tmp
- Size 21KB
- SHA256 0fa7c8fae507fc58a5b6893a340c01f205909a4e91a5e5eac4d1a9822a150edb
- MD5 3d0b1ff9527359a6d7121567a32a89f0
- SHA1 c420837d49317b321154cad1e8da9e7dcca20776
- SHA512 23dc22c6b8f49e55aec9136d19ada68e4587a10cfe89bdb38c3a76fba52053850592b68cc8c55b898814b831f8ff303a820266226e0fe21f2262510db0738dc5
- SSDEEP 384:DsfObTziryIyjpAN1MEOOBpVntnb3FRORCOOP5AR9zhAVV:Ds4T8yIntOqvntnHOkOOPO9z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\SET570.tmp
- Size 26KB
- SHA256 86b986269d85a5288f4ddb4bbd7e78d0bbcf9e274c4c4de224d19e11905c6271
- MD5 f4e9d6bdcb2645695c42f6775b011759
- SHA1 e49e7299d3654b378e77b5e9ad3bf259929cb1c1
- SHA512 0eaad7e81c20ebb663252095023f17ff0504e38cd11ada06c4baffe36bb5d7a1d581d6df4479d6d5882813ccb9ee57fce4a6c30006304c77cee9bb1919fbf6fb
- SSDEEP 384:2fe/IcvIXv6nihUIinqggFjciBlr54tt9hv+KIh8FRJxkGER9z5r8k:2pcg6ihUTr2cVtt9hv+KIQJx+9z1t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\cpbak.sys
- Size 80KB
- SHA256 69a0148be34cee02a743ff96cb7e54e42096a409951804885d2eed861a228a36
- MD5 1f120c062b89686cc5a2a8c3ac1cb199
- SHA1 a0a9cb7193be8663c02e15d8f410f4dade8c8c9b
- SHA512 ed8a06fcc75c50ce0511fa09350f3079beb61ea61a8ecced4c9bad6830c0a9e5e700fa6d1b536ea20089b5a81e4a6867c322e7774d969de5521180cbd30b6abe
- SSDEEP 1536:9zjDNge907MD7SWu7rRUoo/NKIhjSaPkeN5zLGfpB+1iz:9zjafK+rXoT8aPkeNUfpwU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\cpepmon.sys
- Size 184KB
- SHA256 a49e0b9efdf9cef6a5cadee8b87e1ab3b6da5d3169cdd934bdbe400b8cdbb47d
- MD5 c5495709f9547634e3646fab131b96b7
- SHA1 527995898e6830d4c0c241374ca4cf136bf1febb
- SHA512 eea5f3d1c8bf2c62c145e542b7b2209f1fe1d7e4e3c00717efb2ce4d1a579341299768ffd07d2b496f2773235580aca9e7ec3519faab4ead9e123ad408664e90
- SSDEEP 3072:CVo3bbgFsQIkPwd/hGhz9zDCs+xHwPsezEXSASydtV08z0poEqFM3T7FIjC8:CVoLU2QIxhyz9zDmxQPjQiDK0po5FMU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\epelam.sys
- Size 18KB
- SHA256 c697bee49a4290e0ec36151aa3f43c63be9639d62f3b7b3fe96124370e1a2892
- MD5 561b4dfe8bb11d11f1c4e0e97e70a309
- SHA1 95437d094f2ec23e0c35846981dc939f632275ca
- SHA512 631c8ce6608982e8db09471cf017d52191c70c6421d36619cf3bd63caf831023dc6126d2a50cb6d7ba19b31acf763202a6777af1590224b96b966b6ac52d787f
- SSDEEP 192:CGDRxBdIpITETuiOoyfYdFQKKrgwJWVDi5f/VWQ4SWeehI/uuOiqnajl/eA:CGtxHhWuVoyfYdZKrgts/khZildD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\epregflt.sys
- Size 130KB
- SHA256 5e21bd0e6048ca43119c2ec01e5989e12222ee1ef5fb4117579901d80db92dff
- MD5 650931a36e304dc79396e2ca7925d668
- SHA1 a1d2a3824f4fb73b31b78ae47d814b1013f63734
- SHA512 73503307c2b8d4716810925ec14df1bf56432f4a5dd73481e3b28b459d28af9794631d2899d35302b5034a90e16e3a2202c6536dd312b68891cc38c85d475d65
- SSDEEP 3072:QWppitDXo6I6YRx9fvcwbolk5fpu+ZN3mzAHLi+8bd:QgyYRx9XP5hu4NWK0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\trac_install.log
- Size 4KB
- SHA256 ff6d6f92d44d5ff6cee0b5d3db361ca2a00b1e475ef139c104da2c517d855c18
- MD5 010d52b34e8fac3810efc4a9ae3065e2
- SHA1 f414e98ee7cdc9c061dbb13552289525bffd1c86
- SHA512 09fef4fd7355fcf3fcd1c8e08f15fe4def9bdb3f47eddbc4ebc6ef339fb3bf378f137478888879486bfe31089a7935d89737dbc51e25a213d7a2123352921809
- SSDEEP 96:AJBVgyJhGte3UbhIpJy9GIjGuGSG6GMoaHGUUGoxG/9:TaKey9GIjjGSG6GMLHGUUGqG/9
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 18.7MB
- SHA256 f43c4af368680a14446d212b8bbfea6f51ee507b06e8e10a053614017fc3e30a
- MD5 5ee23ed42554f33cf79d5cf90958af3f
- SHA1 2aa3a8359310f2649896088de2b1e202a5b53e0f
- SHA512 896b6fab7858cbf912e0c302271f8f022b754f1568ba70c937a99b9eaa53b3fe4ed079fce3a87020088787f4ad78ce9a51d07b89753cab36770a29c1c5c887b7
- SSDEEP 24576:3jdmqn+pdoO/vvTL8bmOY1LLABw72fNz0h9:en
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{0d06ec8b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3b8c29ca-473e-409c-a8da-c577201725c2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0cd073cb8414a88e154ff3c4987f65c4da225189a649c9d74a0d3d935b4bb4c5
- MD5 9ae0bd95f73596cc032fade1cbd47df8
- SHA1 3b424ddea559b62c4a83ad1730828d5b1fe84e00
- SHA512 257f9954670b84646d034fcf8d0852149c47454a493b13aad53e5b54ab1836f834e10b3e2423114f89bb4199d50c046499bf6a9f6216a2b40a7c974c16290c3c
- SSDEEP 96:FZAgxqYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJN:vAKb++sVeN
- MD5 SHA1 SHA512 SSDEEP