Overview

overview

8

Static

static

3

ZoneAlarmN...NP.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    632s
  • max time network
    635s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-fr
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    ZoneAlarmNGSetup_ZANG_FR_FW_AR8ZNP.exe
  • Size 1.1MB
  • Sample261003-vbc3sat1ex
  • SHA256 e0e0daadd9166ed601a88847626d3368b9a55c25cc4ec8db27caf0a8e92e4359
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 33 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 47 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks for any installed AV software in registry 1 TTPs 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 31 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 33 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZoneAlarmNGSetup_ZANG_FR_FW_AR8ZNP.exe
    "C:\Users\Admin\AppData\Local\Temp\ZoneAlarmNGSetup_ZANG_FR_FW_AR8ZNP.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:5448
    • C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdate.exe
      "C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdate.exe" /installsource taggedmi /install "bundlename=Product&appguid={814E4157-8A6C-461B-A80F-B75931228CA1}&appname=ZoneAlarmNG&needsadmin=True&ap=ZANG_FR_FW&usagestats=1"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5852
      • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
        "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /regsvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Modifies registry class
        PID:2980
      • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
        "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /regserver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:1740
        • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:2096
        • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe
          "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmUpdateComRegisterShell64.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:5452
      • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
        "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTkuMCIgc2hlbGxfdmVyc2lvbj0iMS4zLjk5LjAiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkZEMENBRjQtNkJBNC00MEMwLUJGNTEtRjgyMDA3NkMxQjY5fSIgdXNlcmlkPSJ7QzBEQ0U4MUMtRjgyMS00ODkyLUEzQUQtNTlFMEU1NDkwMzIwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezIwMjhCMEMwLUE1RUUtNDNDQS1BMjQwLTdDOTEzQUZBODc0RX0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuOTkuMCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxNDEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:4872
      • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
        "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /handoff "bundlename=Product&appguid={814E4157-8A6C-461B-A80F-B75931228CA1}&appname=ZoneAlarmNG&needsadmin=True&ap=ZANG_FR_FW&usagestats=1" /installsource taggedmi /sessionid "{2FD0CAF4-6BA4-40C0-BF51-F820076C1B69}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5384
  • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
    "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:2440
  • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
    "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /medsvc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    PID:4656
  • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
    "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:2304
  • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
    "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5880
    • C:\Program Files (x86)\CheckPoint\Update\Install\{C5B88064-0E97-4F81-A209-131BAC3D8613}\ZANG_Install.exe
      "C:\Program Files (x86)\CheckPoint\Update\Install\{C5B88064-0E97-4F81-A209-131BAC3D8613}\ZANG_Install.exe" /Product=ZA_FREE_FW /SKU=AM,AR,FW,WebSecure
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=NoClientID type=211127 meta_data2="{OS_INFO}" int_field1=-1 int_field2=-1 int_field3=0 int_field5=0 int_field6=262 int_field8=-1 int_field9=0 int_field10=240820 str_field1=StopCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="NoSKU" str_field5=NoClientVersion str_field6="NoInstallDate" str_field7="n/a" str_field8="NoLanguage" str_field9="NoUMID" str_field10=NoClientID
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=NoClientID type=211127 meta_data2="{OS_INFO}" int_field1=-1 int_field2=-1 int_field3=0 int_field5=0 int_field6=262 int_field8=-1 int_field9=0 int_field10=240820 str_field1=StopCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="NoSKU" str_field5=NoClientVersion str_field6="NoInstallDate" str_field7="n/a" str_field8="NoLanguage" str_field9="NoUMID" str_field10=NoClientID
          4⤵
          • Executes dropped EXE
          PID:5048
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\system32\sc.exe" query cposfw
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3220
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZA_WSC_ExecVerifier.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZA_WSC_ExecVerifier.exe"
        3⤵
        • Executes dropped EXE
        PID:3576
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\eula.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\eula.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4416
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1 int_field8=1 int_field9=0 int_field10=240829 str_field1=InstallBeginZANG_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1 int_field8=1 int_field9=0 int_field10=240829 str_field1=InstallBeginZANG_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:3972
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\CleanWebSecure.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\CleanWebSecure.exe" /s
        3⤵
        • Executes dropped EXE
        PID:4920
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\system32\sc.exe query ZANG_AV
        3⤵
        • Launches sc.exe
        PID:592
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\system32\sc.exe query AR_Service
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1980
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\system32\sc.exe" query vsdatant
        3⤵
        • Launches sc.exe
        PID:4316
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\system32\sc.exe" query vsmon
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5976
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\system32\sc.exe query ZANG_DAF
        3⤵
        • Launches sc.exe
        PID:2004
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=5 int_field8=1 int_field9=0 int_field10=240830 str_field1=InstallBeginZANG_PrerequisitesInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=5 int_field8=1 int_field9=0 int_field10=240830 str_field1=InstallBeginZANG_PrerequisitesInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:3528
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_Prerequisites.exe
        C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_Prerequisites.exe
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallBeginPrerequisites str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallBeginPrerequisites str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:5600
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2002 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2002 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:5300
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2006 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2006 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:1824
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2008 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqStart str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4864
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2008 int_field8=1 int_field9=0 int_field10=240833 str_field1=InstallPrereqStart str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            PID:5900
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x64.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x64.exe" /quiet /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC12 Runtimes x64.log"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x64.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x64.exe" /quiet /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC12 Runtimes x64.log" -burn.unelevated BurnPipe.{575854F0-A131-4EEA-8C83-03784B4B925D} {FD5661C0-9F43-4ADE-82BC-4E136B65C845} 4544
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:5860
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2008 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSuccess str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3104
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2008 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSuccess str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            PID:5964
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2010 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2010 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            PID:696
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2005 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3816
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2005 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:2912
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2007 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqRepair str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:252
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2007 int_field8=1 int_field9=0 int_field10=240851 str_field1=InstallPrereqRepair str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            PID:4416
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC11 Runtimes x86.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC11 Runtimes x86.exe" /quiet /repair /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC11 Runtimes x86.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC11 Runtimes x86.exe" /quiet /repair /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" -burn.unelevated BurnPipe.{97C0F242-D6C8-4260-BEFA-89BA6B03CB36} {88437090-AE70-46F9-A0D9-EC0380D941DA} 1432
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6048
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2007 int_field8=1 int_field9=0 int_field10=240869 str_field1=InstallPrereqRepairSuccess str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2007 int_field8=1 int_field9=0 int_field10=240869 str_field1=InstallPrereqRepairSuccess str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            PID:6068
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2009 int_field8=1 int_field9=0 int_field10=240869 str_field1=InstallPrereqStart str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:472
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\dltel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2009 int_field8=1 int_field9=0 int_field10=240869 str_field1=InstallPrereqStart str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            5⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:696
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x86.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x86.exe" /quiet /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC12 Runtimes x86.log"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5824
          • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x86.exe
            "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x86.exe" /quiet /norestart /log "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC12 Runtimes x86.log" -burn.unelevated BurnPipe.{BAE15AC3-84ED-4A8A-B01D-0C1AEEAD0C3B} {A7103158-13A0-4125-A080-FBF876A92A01} 5824
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3120
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2009 int_field8=1 int_field9=0 int_field10=240870 str_field1=InstallPrereqSuccess str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          PID:3928
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2011 int_field8=1 int_field9=0 int_field10=240870 str_field1=InstallPrereqSkip str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          PID:1740
        • C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe
          "C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\zangitel.exe" client_version=4.4.44.20392 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1001 int_field8=1 int_field9=40328 int_field10=240870 str_field1=InstallEndPrerequisites str_field2="ZANG_FR_FW" str_field3=4.4.44.20392 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          PID:3356
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=5 int_field8=1 int_field9=40672 int_field10=240870 str_field1=InstallEndZANG_PrerequisitesInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=5 int_field8=1 int_field9=40672 int_field10=240870 str_field1=InstallEndZANG_PrerequisitesInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          PID:2240
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\system32\sc.exe query WscHelper
        3⤵
        • Launches sc.exe
        PID:5756
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=14 int_field8=1 int_field9=0 int_field10=240871 str_field1=InstallBeginEPElamDrv str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5132
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=14 int_field8=1 int_field9=0 int_field10=240871 str_field1=InstallBeginEPElamDrv str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:6044
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\system32\msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\EPElamDrv.msi" /qn /norestart /l*v+ "C:\ProgramData\CheckPoint\ZANG\Logs\Install\EPElamDrv.log"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:4216
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=14 int_field8=1 int_field9=1579 int_field10=240872 str_field1=InstallEndEPElamDrv str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
        • Executes dropped EXE
        PID:1952
        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=14 int_field8=1 int_field9=1579 int_field10=240872 str_field1=InstallEndEPElamDrv str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          PID:5012
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\system32\sc.exe query TESvc
        3⤵
        • Launches sc.exe
        PID:2432
      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=6 int_field8=1 int_field9=0 int_field10=240873 str_field1=InstallBeginSBA_FW64_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
        3⤵
          PID:800
          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=6 int_field8=1 int_field9=0 int_field10=240873 str_field1=InstallBeginSBA_FW64_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
            4⤵
              PID:5072
          • C:\Windows\SysWOW64\sc.exe
            C:\Windows\system32\sc.exe query iswkl
            3⤵
            • Launches sc.exe
            PID:5044
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:6068
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe -i "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\SBA_FW64.msi" /q /norestart /l*v+ "C:\ProgramData\CheckPoint\ZANG\Logs\Install\SBA_FW64.log" SUPPORTDIR="C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp" ZA_MODE="ZANG" PRODDISPLAYNAME.F87AF79D_F10E_4FC8_A4A1_7A12C7210F71="ZoneAlarm NextGen" DONOTSTARTSERVICES=1 EP_VC32_INSTALLED=1 EP_VC64_INSTALLED=1
              3⤵
              • Suspicious use of SetWindowsHookEx
              PID:5996
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe query vsmon
              3⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3440
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe failure vsmon reset= 0 actions= restart/0/restart/0/restart/0
              3⤵
              • Launches sc.exe
              PID:2852
            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=6 int_field8=1 int_field9=234766 int_field10=241107 str_field1=InstallEndSBA_FW64_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
              3⤵
                PID:1464
                • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                  "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=6 int_field8=1 int_field9=234766 int_field10=241107 str_field1=InstallEndSBA_FW64_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                  4⤵
                    PID:2304
                • C:\Windows\SysWOW64\regsvr32.exe
                  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CheckPoint\ZANG\Common\ZANGShExt.dll"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3476
                  • C:\Windows\system32\regsvr32.exe
                    /s "C:\Program Files (x86)\CheckPoint\ZANG\Common\ZANGShExt.dll"
                    4⤵
                      PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                    "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=271 int_field8=1 int_field9=0 int_field10=241107 str_field1=InstallRegisterZANGShExt str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                    3⤵
                      PID:1164
                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=271 int_field8=1 int_field9=0 int_field10=241107 str_field1=InstallRegisterZANGShExt str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                        4⤵
                        • Reads the TCP/IP host and domain name from the registry
                        PID:4204
                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=4 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallBeginZANG_MgrSvcInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                      3⤵
                        PID:4396
                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=4 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallBeginZANG_MgrSvcInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                          4⤵
                          • Reads the TCP/IP host and domain name from the registry
                          PID:1220
                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_MgrSvc_Install.exe
                        C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_MgrSvc_Install.exe
                        3⤵
                        • Drops file in Drivers directory
                        • Drops file in Program Files directory
                        PID:6044
                        • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                          "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallBeginZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                          4⤵
                            PID:2852
                            • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe
                              "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallBeginZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                              5⤵
                              • Reads the TCP/IP host and domain name from the registry
                              PID:3440
                          • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                            "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1015 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallExecInstallZANG_MgrSvcCore str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                            4⤵
                              PID:2304
                              • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe
                                "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1015 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallExecInstallZANG_MgrSvcCore str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                5⤵
                                • Reads the TCP/IP host and domain name from the registry
                                PID:4692
                            • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                              "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                              4⤵
                                PID:3520
                                • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe
                                  "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241108 str_field1=InstallCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                  5⤵
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:2936
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe query cposfw
                                4⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:4672
                              • C:\Windows\System32\InfDefaultInstall.exe
                                "C:\Windows\System32\InfDefaultInstall.exe" "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\cposfw.inf"
                                4⤵
                                • Drops file in Drivers directory
                                • Adds Run key to start application
                                PID:5772
                                • C:\Windows\system32\runonce.exe
                                  "C:\Windows\system32\runonce.exe" -r
                                  5⤵
                                  • Checks processor information in registry
                                  PID:3160
                                  • C:\Windows\System32\grpconv.exe
                                    "C:\Windows\System32\grpconv.exe" -o
                                    6⤵
                                      PID:2840
                                • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                                  "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241109 str_field1=InstallCPOSFW_InstallFinish str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                  4⤵
                                    PID:1832
                                    • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe
                                      "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\dltel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241109 str_field1=InstallCPOSFW_InstallFinish str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                      5⤵
                                        PID:476
                                    • C:\Windows\SysWOW64\sc.exe
                                      C:\Windows\system32\sc.exe query ZANG_MgrSvc
                                      4⤵
                                      • Launches sc.exe
                                      • System Location Discovery: System Language Discovery
                                      PID:824
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "/LogFile=C:\ProgramData\CheckPoint\ZANG\Logs\MgrSvc\ZANG_MgrSvc_InstallUtil.log" "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc.exe"
                                      4⤵
                                        PID:3484
                                      • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                                        "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1008 int_field8=1 int_field9=0 int_field10=241110 str_field1=InstallExecInstallUtilZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                        4⤵
                                          PID:6640
                                        • C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe
                                          "C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1001 int_field8=1 int_field9=2156 int_field10=241110 str_field1=InstallEndZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                          4⤵
                                            PID:6656
                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=4 int_field8=1 int_field9=2547 int_field10=241110 str_field1=InstallEndZANG_MgrSvcInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                          3⤵
                                            PID:6796
                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=4 int_field8=1 int_field9=2547 int_field10=241110 str_field1=InstallEndZANG_MgrSvcInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                              4⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:6920
                                          • C:\Windows\SysWOW64\SC.exe
                                            C:\Windows\system32\SC.exe failure ZANG_MgrSvc reset= 0 actions= restart/0/restart/0/restart/0
                                            3⤵
                                            • Launches sc.exe
                                            PID:6824
                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2 int_field8=1 int_field9=0 int_field10=241111 str_field1=InstallBeginZANG_AR_MGR_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                            3⤵
                                              PID:7152
                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2 int_field8=1 int_field9=0 int_field10=241111 str_field1=InstallBeginZANG_AR_MGR_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                4⤵
                                                • Reads the TCP/IP host and domain name from the registry
                                                PID:2652
                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_AR_MGR_Install.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_AR_MGR_Install.exe
                                              3⤵
                                              • Drops file in Program Files directory
                                              PID:2364
                                              • C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe
                                                "C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe" client_version=4.4.151.20697 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241111 str_field1=InstallBeginZANG_AR_MGR str_field2="ZANG_FR_FW" str_field3=4.4.151.20697 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                4⤵
                                                  PID:6872
                                                  • C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\dltel.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\dltel.exe" client_version=4.4.151.20697 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241111 str_field1=InstallBeginZANG_AR_MGR str_field2="ZANG_FR_FW" str_field3=4.4.151.20697 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                    5⤵
                                                      PID:6152
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    C:\Windows\system32\sc.exe query AR_Service
                                                    4⤵
                                                    • Launches sc.exe
                                                    PID:6176
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "/LogFile=C:\ProgramData\CheckPoint\ZANG\Logs\AR\AR_Service_InstallUtil.log" "C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.exe"
                                                    4⤵
                                                      PID:6420
                                                    • C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe" client_version=4.4.151.20697 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241113 str_field1=InstallExecInstallUtilAR_Service str_field2="ZANG_FR_FW" str_field3=4.4.151.20697 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                      4⤵
                                                        PID:6504
                                                      • C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsa115F.tmp\zangitel.exe" client_version=4.4.151.20697 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1001 int_field8=1 int_field9=1859 int_field10=241113 str_field1=InstallEndZANG_AR_MGR str_field2="ZANG_FR_FW" str_field3=4.4.151.20697 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                        4⤵
                                                          PID:824
                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2 int_field8=1 int_field9=2282 int_field10=241113 str_field1=InstallEndZANG_AR_MGR_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                        3⤵
                                                          PID:6348
                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=2 int_field8=1 int_field9=2282 int_field10=241113 str_field1=InstallEndZANG_AR_MGR_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                            4⤵
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            PID:6512
                                                        • C:\Windows\SysWOW64\SC.exe
                                                          C:\Windows\system32\SC.exe failure AR_Service reset= 0 actions= restart/0/restart/0/restart/0
                                                          3⤵
                                                          • Launches sc.exe
                                                          • System Location Discovery: System Language Discovery
                                                          PID:6412
                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=9 int_field8=1 int_field9=0 int_field10=241113 str_field1=InstallBeginZANG_AV_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                          3⤵
                                                            PID:7080
                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=9 int_field8=1 int_field9=0 int_field10=241113 str_field1=InstallBeginZANG_AV_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                              4⤵
                                                                PID:3536
                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_AV_Install.exe
                                                              C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_AV_Install.exe
                                                              3⤵
                                                              • Drops file in Program Files directory
                                                              PID:6280
                                                              • C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241155 str_field1=InstallBeginZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                4⤵
                                                                  PID:6384
                                                                  • C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\dltel.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\dltel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241155 str_field1=InstallBeginZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                    5⤵
                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                    PID:6704
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  C:\Windows\system32\sc.exe query ZANG_AV
                                                                  4⤵
                                                                  • Launches sc.exe
                                                                  PID:6148
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "/LogFile=C:\ProgramData\CheckPoint\ZANG\Logs\AV\ZANG_AV_InstallUtil.log" "C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV.exe"
                                                                  4⤵
                                                                    PID:1592
                                                                  • C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1002 int_field8=1 int_field9=0 int_field10=241156 str_field1=InstallExecInstallUtilZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                    4⤵
                                                                      PID:6396
                                                                    • C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\nsnBD5E.tmp\zangitel.exe" client_version=4.4.109.20441 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1001 int_field8=1 int_field9=828 int_field10=241156 str_field1=InstallEndZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.109.20441 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                      4⤵
                                                                        PID:3540
                                                                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=9 int_field8=1 int_field9=42687 int_field10=241156 str_field1=InstallEndZANG_AV_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                      3⤵
                                                                        PID:6204
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=9 int_field8=1 int_field9=42687 int_field10=241156 str_field1=InstallEndZANG_AV_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                          4⤵
                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                          PID:5280
                                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=11 int_field8=1 int_field9=0 int_field10=241156 str_field1=InstallBeginZANG_SophosInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                        3⤵
                                                                          PID:4672
                                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=11 int_field8=1 int_field9=0 int_field10=241156 str_field1=InstallBeginZANG_SophosInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                            4⤵
                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                            PID:4384
                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=11 int_field8=1 int_field9=2953 int_field10=241159 str_field1=InstallEndZANG_SophosInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                          3⤵
                                                                            PID:3828
                                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=11 int_field8=1 int_field9=2953 int_field10=241159 str_field1=InstallEndZANG_SophosInstall str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                              4⤵
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              PID:7108
                                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=3 int_field8=1 int_field9=0 int_field10=241159 str_field1=InstallBeginZANG_UI_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                            3⤵
                                                                              PID:5812
                                                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=3 int_field8=1 int_field9=0 int_field10=241159 str_field1=InstallBeginZANG_UI_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                4⤵
                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                PID:5300
                                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_UI_Install.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZANG_UI_Install.exe
                                                                              3⤵
                                                                              • Adds Run key to start application
                                                                              • Drops file in Program Files directory
                                                                              PID:2896
                                                                              • C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\zangitel.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\zangitel.exe" client_version=4.4.161.20562 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241159 str_field1=InstallBeginZANG_UI str_field2="ZANG_FR_FW" str_field3=4.4.161.20562 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                4⤵
                                                                                  PID:3988
                                                                                  • C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\dltel.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\dltel.exe" client_version=4.4.161.20562 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=0 int_field10=241159 str_field1=InstallBeginZANG_UI str_field2="ZANG_FR_FW" str_field3=4.4.161.20562 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                    5⤵
                                                                                      PID:6824
                                                                                  • C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\zangitel.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\nspCDBA.tmp\zangitel.exe" client_version=4.4.161.20562 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1000 int_field8=1 int_field9=656 int_field10=241160 str_field1=InstallEndZANG_UI str_field2="ZANG_FR_FW" str_field3=4.4.161.20562 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                    4⤵
                                                                                      PID:4296
                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=3 int_field8=1 int_field9=1156 int_field10=241160 str_field1=InstallEndZANG_UI_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                    3⤵
                                                                                      PID:3224
                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=3 int_field8=1 int_field9=1156 int_field10=241160 str_field1=InstallEndZANG_UI_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="NoInstallDate" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                        4⤵
                                                                                          PID:4292
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" > C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:7156
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo Install Information - Product Version=4.4.217.20710" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:1576
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:6276
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:6344
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo Version Information" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:5112
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2096
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe" "C:\Program Files (x86)\CheckPoint" true *.exe;*.dll;*.sys" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:6884
                                                                                        • C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe
                                                                                          "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe" "C:\Program Files (x86)\CheckPoint" true *.exe;*.dll;*.sys
                                                                                          4⤵
                                                                                            PID:6200
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe" "C:\Windows\System32\ZoneLabs" true *.exe;*.dll;*.sys" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                          3⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:7056
                                                                                          • C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe
                                                                                            "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\EnumVerInfo.exe" "C:\Windows\System32\ZoneLabs" true *.exe;*.dll;*.sys
                                                                                            4⤵
                                                                                              PID:2980
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                            3⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:5892
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c "@Echo Hashes" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                            3⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:5024
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c "@Echo --------------------------------------------------------------------------------" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                            3⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3524
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe" "C:\Program Files (x86)\CheckPoint" all dash true *.exe;*.dll" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                            3⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:6876
                                                                                            • C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe
                                                                                              "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe" "C:\Program Files (x86)\CheckPoint" all dash true *.exe;*.dll
                                                                                              4⤵
                                                                                                PID:6236
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe" "C:\Windows\SysWOW64\ZoneLabs" all dash true *.exe;*.dll" >> C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                              3⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:6176
                                                                                              • C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe
                                                                                                "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\cpinfo\Hashes.exe" "C:\Windows\SysWOW64\ZoneLabs" all dash true *.exe;*.dll
                                                                                                4⤵
                                                                                                  PID:1724
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                C:\Windows\system32\sc.exe query ZANG_DAF
                                                                                                3⤵
                                                                                                • Launches sc.exe
                                                                                                PID:3528
                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe
                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe" /Service
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry class
                                                                                                PID:6228
                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallRegisterZANG_DAF_Service str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                3⤵
                                                                                                  PID:6488
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallRegisterZANG_DAF_Service str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                    4⤵
                                                                                                      PID:7124
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    C:\Windows\system32\sc.exe query ZA_WSC
                                                                                                    3⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:2604
                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\AV\ZA_WSC.exe
                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\AV\ZA_WSC.exe" /Service
                                                                                                    3⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:6480
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=18 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallStartProc_ZA_WSC str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                    3⤵
                                                                                                      PID:1208
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=18 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallStartProc_ZA_WSC str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                        4⤵
                                                                                                          PID:6680
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=13 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallQueryCPEFR str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                        3⤵
                                                                                                          PID:3484
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=13 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallQueryCPEFR str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                            4⤵
                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                            PID:6612
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=-2147023828 int_field6=13 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallStartCPEFR str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                          3⤵
                                                                                                            PID:6744
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=-2147023828 int_field6=13 int_field8=1 int_field9=0 int_field10=241182 str_field1=InstallStartCPEFR str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                              4⤵
                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                              PID:5232
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            C:\Windows\system32\net.exe start ZANG_MgrSvc
                                                                                                            3⤵
                                                                                                              PID:6704
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 start ZANG_MgrSvc
                                                                                                                4⤵
                                                                                                                  PID:3640
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241185 str_field1=InstallStartProc_ZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                3⤵
                                                                                                                  PID:1476
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241185 str_field1=InstallStartProc_ZANG_MgrSvc str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                    4⤵
                                                                                                                      PID:1348
                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                    C:\Windows\system32\net.exe start AR_Service
                                                                                                                    3⤵
                                                                                                                      PID:760
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        4⤵
                                                                                                                          PID:7108
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 start AR_Service
                                                                                                                          4⤵
                                                                                                                            PID:6692
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241188 str_field1=InstallStartProc_AR_Service str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                          3⤵
                                                                                                                            PID:5472
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241188 str_field1=InstallStartProc_AR_Service str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                              4⤵
                                                                                                                                PID:3388
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              C:\Windows\system32\net.exe start ZANG_AV
                                                                                                                              3⤵
                                                                                                                                PID:6988
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 start ZANG_AV
                                                                                                                                  4⤵
                                                                                                                                    PID:6284
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241190 str_field1=InstallStartProc_ZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                  3⤵
                                                                                                                                    PID:6428
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241190 str_field1=InstallStartProc_ZANG_AV str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                      4⤵
                                                                                                                                        PID:4428
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241190 str_field1=InstallStartProc_VSMon str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                      3⤵
                                                                                                                                        PID:3368
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241190 str_field1=InstallStartProc_VSMon str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                          4⤵
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          PID:1908
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=22 int_field8=1 int_field9=0 int_field10=241310 str_field1=InstallVSMonInitError str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                        3⤵
                                                                                                                                          PID:6312
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=22 int_field8=1 int_field9=0 int_field10=241310 str_field1=InstallVSMonInitError str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                            4⤵
                                                                                                                                              PID:476
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241310 str_field1=InstallStartProc_CpSecHost str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                            3⤵
                                                                                                                                              PID:2544
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=12 int_field8=1 int_field9=0 int_field10=241310 str_field1=InstallStartProc_CpSecHost str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                                4⤵
                                                                                                                                                  PID:1804
                                                                                                                                              • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                NET.exe start epnetflt
                                                                                                                                                3⤵
                                                                                                                                                  PID:5492
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 start epnetflt
                                                                                                                                                    4⤵
                                                                                                                                                      PID:7520
                                                                                                                                                  • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                    NET.exe start cpepmon
                                                                                                                                                    3⤵
                                                                                                                                                      PID:7640
                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                        C:\Windows\system32\net1 start cpepmon
                                                                                                                                                        4⤵
                                                                                                                                                          PID:7720
                                                                                                                                                      • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                        NET.exe start epregflt
                                                                                                                                                        3⤵
                                                                                                                                                          PID:7772
                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                            C:\Windows\system32\net1 start epregflt
                                                                                                                                                            4⤵
                                                                                                                                                              PID:7856
                                                                                                                                                          • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                            NET.exe start cpbak
                                                                                                                                                            3⤵
                                                                                                                                                              PID:8024
                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                C:\Windows\system32\net1 start cpbak
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:8148
                                                                                                                                                              • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                NET.exe start RemediationService
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:7200
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6284
                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                      C:\Windows\system32\net1 start RemediationService
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:7272
                                                                                                                                                                    • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                      "C:\Windows\system32\NET.exe" start CPFileAnlyz
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:7400
                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                          C:\Windows\system32\net1 start CPFileAnlyz
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:7360
                                                                                                                                                                        • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                          NET.exe start CpSbaCipolla
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6824
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 start CpSbaCipolla
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:7488
                                                                                                                                                                            • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                              NET.exe start CpSbaUpdater
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:628
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 start CpSbaUpdater
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:7816
                                                                                                                                                                                • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                                  NET.exe start Iswkl
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6456
                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                      C:\Windows\system32\net1 start Iswkl
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1348
                                                                                                                                                                                    • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                                      NET.exe start EpabService
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:7332
                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 start EpabService
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2652
                                                                                                                                                                                        • C:\Windows\SysWOW64\SC.exe
                                                                                                                                                                                          C:\Windows\system32\SC.exe failure EpabService reset= 0 actions= restart/0/restart/0/restart/0
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:6316
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1 int_field8=1 int_field9=492562 int_field10=241321 str_field1=InstallEndZANG_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3036
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=0 int_field6=1 int_field8=1 int_field9=492562 int_field10=241321 str_field1=InstallEndZANG_Install str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:7644
                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                              "C:\Windows\system32\sc.exe" query cposfw
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:7512
                                                                                                                                                                                            • C:\Windows\SysWOW64\NET.exe
                                                                                                                                                                                              "C:\Windows\system32\NET.exe" start cposfw
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:7404
                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                  C:\Windows\system32\net1 start cposfw
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:8032
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=2 int_field6=7 int_field8=1 int_field9=0 int_field10=241322 str_field1=InstallStartCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7896
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe" client_version=4.4.217.20710 unique_client=0844E139D27CD74C83B5BAADCC7C5FA2 type=211127 meta_data2="{OS_INFO}" int_field1=1 int_field2=1 int_field3=0 int_field5=2 int_field6=7 int_field8=1 int_field9=0 int_field10=241322 str_field1=InstallStartCPOSFW str_field2="ZANG_FR_FW" str_field3=4.4.217.20710 str_field4="AM,AR,FW,WebSecure" str_field5=4.4.217.20710 str_field6="1791046197" str_field7="n/a" str_field8="fr-FR" str_field9="NoUMID" str_field10=0844E139D27CD74C83B5BAADCC7C5FA2
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:1440
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\completed.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\completed.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4044
                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler64.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler64.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTkuMCIgc2hlbGxfdmVyc2lvbj0iMS4zLjk5LjAiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkZEMENBRjQtNkJBNC00MEMwLUJGNTEtRjgyMDA3NkMxQjY5fSIgdXNlcmlkPSJ7QzBEQ0U4MUMtRjgyMS00ODkyLUEzQUQtNTlFMEU1NDkwMzIwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezMzNTAyRDlELTNFRjctNDY0RC1CQTJGLTgzRTNBNEFFMkFCMn0iIGRlZHVwPSJjciI-PGh3IHBoeXNtZW1vcnk9IjE2IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4MTRFNDE1Ny04QTZDLTQ2MUItQTgwRi1CNzU5MzEyMjhDQTF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSI0LjQuMjE3LjIwNzEwIiBhcD0iWkFOR19GUl9GVyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vZG93bmxvYWQuem9uZWFsYXJtLmNvbS9iaW4vZnJlZS9kb3dubG9hZHMvWkFORy9aQU5HM19TT1BILzRfNF8yMTcvWkFOR19JbnN0YWxsLmV4ZSIgZG93bmxvYWRlZD0iNDk1NzY0MTI4IiB0b3RhbD0iNDk1NzY0MTI4IiBkb3dubG9hZF90aW1lX21zPSI0OTc2OSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjcwMCIgZG93bmxvYWRfdGltZV9tcz0iNTI4MDEiIGRvd25sb2FkZWQ9IjQ5NTc2NDEyOCIgdG90YWw9IjQ5NTc2NDEyOCIgaW5zdGFsbF90aW1lX21zPSI1MDgzNDYiLz48L2FwcD48L3JlcXVlc3Q-
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                          PID:6316
                                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                        • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" -burn.unelevated BurnPipe.{0EFFB542-A7E4-4051-8DE7-AAD894A4800F} {08813662-B486-491C-97AC-5D0816659381} 1984
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                        • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4340
                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding A7CE3B1CEE06CBEA22094B693F525995
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                            • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                              C:\Windows\System32\MsiExec.exe -Embedding F3F33E61A0E1CB565039EFF6FA9C9F8B E Global\MSI0000
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 18B2F43DEF75EE5AB2232E917E3F1C87
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • Badlisted process makes network request
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\epklib_tester.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\epklib_tester.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4552
                                                                                                                                                                                                              • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                                C:\Windows\System32\MsiExec.exe -Embedding D1374F00BA398A8023194A45DDCAA381
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding F0DF48821571789F9EC364FC38EE8110 E Global\MSI0000
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                • C:\Windows\SysWOW64\ZoneLabs\vsdrInst.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\ZoneLabs\vsdrInst.exe -i C:\Windows\SysWOW64\ZoneLabs\vsdatant.inf
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\sc.exe" create ISWKL binpath= "C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\ISWKL.sys" type= kernel start= auto
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                              • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                                C:\Windows\System32\MsiExec.exe -Embedding 91EAAA2F0230C0403F1D96B73EA88CDC E Global\MSI0000
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" config CpSbaCipolla start= delayed-auto
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" failure CpSbaCipolla reset= 30 actions= restart/500
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" config CpSbaUpdater start= delayed-auto
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" failure CpSbaUpdater reset= 30 actions= restart/500
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:1588
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" failure CPEFR reset= 30 actions= restart/500
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" config RemediationService start= delayed-auto
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" failure RemediationService reset= 30 actions= restart/500
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:3580
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" config CPFileAnlyz start= delayed-auto
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" failure CPFileAnlyz reset= 30 actions= restart/500
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\IntelTDT\install_tdt_driver.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\IntelTDT\install_tdt_driver.exe" -i -v
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                PID:3988
                                                                                                                                                                                                              • C:\Windows\Installer\MSIFD2A.tmp
                                                                                                                                                                                                                "C:\Windows\Installer\MSIFD2A.tmp"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored /burn.runonce
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored -burn.unelevated BurnPipe.{21064107-D89B-4C25-86B2-51C6943718FC} {7265089D-4B9F-4379-88E8-B3431FA9616C} 2368
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" /burn.runonce
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1160
                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:940
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe" -burn.unelevated BurnPipe.{D272456F-6E7B-40E9-841C-483177A788C0} {14D8F40B-362A-4FCB-90C8-2DFC0A324CC4} 940
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:3988
                                                                                                                                                                                                              • C:\Windows\system32\drivers\epelam.sys
                                                                                                                                                                                                                C:\Windows\system32\drivers\epelam.sys
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored /burn.runonce
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:5756
                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored -burn.unelevated BurnPipe.{F3FCF3BD-9AAB-4862-AFF5-8F51D4A8F89E} {AEF5CDE9-B318-438D-8461-B6F7397B5301} 5756
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored -burn.unelevated BurnPipe.{BE9B4650-2802-40C6-B89B-C177CA387095} {C59E9C98-6E32-4586-8434-53BEA03BA5C1} 4300
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                    • C:\Windows\System32\Drivers\IntelTDT.sys
                                                                                                                                                                                                                      C:\Windows\System32\Drivers\IntelTDT.sys
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                      • C:\Windows\system32\DRIVERS\cpdhnypt.sys
                                                                                                                                                                                                                        system32\DRIVERS\cpdhnypt.sys
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                        • C:\Windows\system32\DRIVERS\cpbak.sys
                                                                                                                                                                                                                          system32\DRIVERS\cpbak.sys
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                          • C:\Windows\system32\drivers\epregflt.sys
                                                                                                                                                                                                                            C:\Windows\system32\drivers\epregflt.sys
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                            • C:\Windows\system32\DRIVERS\cpdiskflt.sys
                                                                                                                                                                                                                              system32\DRIVERS\cpdiskflt.sys
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                              • C:\Windows\system32\drivers\epnetflt.sys
                                                                                                                                                                                                                                C:\Windows\system32\drivers\epnetflt.sys
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                                • C:\Windows\system32\drivers\cpdevmon.sys
                                                                                                                                                                                                                                  C:\Windows\system32\drivers\cpdevmon.sys
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                  • C:\Windows\system32\DRIVERS\CPEPMon.sys
                                                                                                                                                                                                                                    system32\DRIVERS\CPEPMon.sys
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Endpoint Security\AntiBot\epab_svc.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Endpoint Security\AntiBot\epab_svc.exe" --service
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                      PID:4684
                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe" service
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\EFRService.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\EFRService.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4596
                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\CPFileAnlyz.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\Endpoint Security\Threat Emulation\CPFileAnlyz.exe" -s
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                          DrvInst.exe "4" "1" "C:\Windows\SysWOW64\ZoneLabs\vsdatant.inf" "9" "493f6c84b" "0000000000000130" "WinSta0\Default" "000000000000017C" "208" "C:\Windows\SysWOW64\ZoneLabs"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                          PID:1836
                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{43DBFA17-32F4-4354-8B27-62B3BF2E4B8A} {6285CBBC-7F98-44D1-9F0C-8FD5BF2DF7D1} 2008
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                            • C:\Windows\system32\drivers\epklibproxy.sys
                                                                                                                                                                                                                                              C:\Windows\system32\drivers\epklibproxy.sys
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A7D36E7D-6E4A-48C3-9C94-05DC11408F85} {A4D21B1C-EF64-4CBD-B59A-4FF22B619D41} 2188
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D9EE7965-0BB4-4E1D-AF60-62F34323A69A} {412F9605-B736-40BC-9781-44D27048EAB5} 3400
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{72DCE4B0-D703-40F5-9664-10DBBB62AA62} {8B544133-2E0F-4DB5-A713-1FD5CE8A7DBF} 5748
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{13B80DB6-1178-40F3-890D-9AC61FD824D2} {98E711F0-8D65-41C8-9934-EF679491FF96} 2372
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:1292
                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{FF7B6733-D2CD-4DEB-940E-14B0AB4BEB2B} {2FB9319D-D32C-41AC-A7BE-EACE6B2B4A06} 5088
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                PID:1272
                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{DF9CD3E6-E41A-4023-94F3-4A5154138B5A} {7E115587-63AE-4415-9156-047711988ADF} 1272
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6BA33D06-CE67-42E7-9199-6D483208C8DC} {A239EC46-9580-44D7-A074-11E44185CFC2} 4472
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8CCE6392-693D-4D1C-A842-DA54186F6728} {7500EC9D-8636-45D0-B608-E359B2081CD7} 1172
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{72587570-9942-45A5-9E80-15E675000603} {E5A93CE0-C1EC-430F-8537-25DC57DE3681} 1556
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B824C820-B342-45E5-8B21-966D242015C9} {061235BB-EBB0-4F40-8E60-EDEDB76046D5} 1568
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:2680
                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9E859D84-4DCA-4B56-BF92-BBA79BB3B24E} {671AAC1B-C631-4E2B-82D3-FA8A8D3A3D9F} 5052
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1924
                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A6B13119-A597-4E94-A123-B3D422790DAF} {797C9794-8E77-4D72-99D0-81A91411F061} 3364
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1348
                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          PID:2400
                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{CBC6A261-FA87-46DF-9479-0BC8DD7FD4CC} {C2666A0B-46A8-4EC8-8336-E438042D735A} 2400
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3608
                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:4416
                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{15077002-CC20-4BE1-BE08-261BBCCD4FC5} {0BB9E387-5A34-4779-91A0-9381C7ACCCB3} 6052
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:2724
                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{076E2F05-4507-4064-AB9D-2226528AAF35} {653FAC8A-34A0-4E0E-9B5C-D1E271D6036D} 828
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2004
                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{293C73EE-41F3-4F2F-880B-B10134777E81} {C6E1C7C2-9CD3-42F9-AEDE-8471E9BC1E9F} 1376
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B5A35046-CA92-48F7-B7FB-4FFF2DDC6C0A} {54EC6974-8037-4219-9391-89F3FD217B8E} 4196
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5376
                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6FACF939-0300-4420-B9F7-2ACA70831A5B} {A93D64B2-9325-4DC3-8E54-2496A3FD62DE} 1268
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{78D5C8E4-8C8A-4226-8B74-B9BD3FD7F2E2} {ECB3969C-3F13-4B9D-B471-BCBC697ED034} 2472
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                              PID:928
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7FF86355-8EEF-4815-AE46-CCA2E9A1BA25} {85C97960-24F6-4146-82D6-74F6CBE0C69D} 928
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:5864
                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9E223FD1-9AFD-4AD9-A33E-E3E4C32C98A1} {DD64A052-2717-43DB-9C9D-60B1539891D4} 5864
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C19542F6-E79C-4317-BBFC-0B394F8C6625} {CAA6A247-E14D-4EE6-8734-B3E845209DDE} 2376
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B4C31629-8322-4867-AB4A-B260E21646EA} {AB31AA6C-326D-4B40-BEB9-D317AB8D5F34} 1236
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1411A868-69D5-4E6E-B22A-1412E8C842DD} {80805EA9-6038-4165-9660-A3CF744F073E} 2868
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1368
                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9A37CB3C-1147-407E-8426-4D62B1833F3B} {CD0BFC06-F99B-4863-B000-252149AD0FBB} 3096
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3680
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                PID:2848
                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{501E535E-9999-49EE-8B46-3FE8D137E2D5} {F0DC849B-AC12-46FE-9B65-94BA9D5A2E50} 2848
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{BC4F2987-76D2-4905-929A-1FF7D1BC5F3C} {A0356514-1B89-474F-8822-1FA129478511} 5104
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1212
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /c
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /cr
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1980
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler64.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\1.3.99.0\ZoneAlarmCrashHandler64.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /ua /installsource core
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /ua /installsource scheduler
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                    PID:2968
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /registermsihelper
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Update\ZoneAlarmUpdate.exe" /uninstall
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9F667C81-B6DA-4B40-83B2-4D49516A49FE} {73C5B0C2-783D-46D1-948F-CE5E4F043F92} 2212
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5AE64A4C-E960-40AC-BF72-A66BCCB1DAE3} {DC7B3E2E-57EF-45FA-B017-7A4B35EE9790} 764
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:4876
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{4F8D2792-74AF-48C1-8615-4371852521F8} {39786388-4152-4335-ADB2-BBEC60A44CD7} 4516
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:5148
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:5124
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8D0DD798-F674-49AB-A349-3BE3623B1CE9} {170C2C5C-BBAD-444F-8FDA-A12CB5330FF3} 4708
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1888
                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{2F2B5191-90ED-4FAD-9AD7-FBAB9C1CF6AB} {D886BA69-AA9B-43D8-88CD-C76435DEA5A4} 1116
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B7053728-F0C4-4DF7-903E-E62D0A1B3DBC} {95C85441-FC86-4316-B8B6-BE861CF29AF7} 2900
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5388
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{062C8430-020F-46F0-B621-2D49DF9F461D} {CF53133F-A545-4DCB-B054-DBE08F776FFA} 6076
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5936
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                  PID:1928
                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D4531CB0-748D-415E-8DDB-EEF6B26E7D21} {58C9B2EE-D4A7-42B2-BB3C-9844EE8699AA} 1928
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{89E9FFC9-7E35-4190-A420-D495DC401788} {63EAFF3F-4EF0-41F0-AC49-DF4DC0B933BB} 1052
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1868
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:1308
                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{01B43465-2891-4960-A1C4-B1323F3ABD89} {72B58256-3D91-4FD9-BACD-85CF912C3F4B} 1308
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{AA2E4CED-1FC5-4EBA-AF05-DAF9ACC6D8AA} {9D29501F-A190-478E-9A75-E507CBD6C352} 3592
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DRIVERS\cposfw.sys
                                                                                                                                                                                                                                                                                                                                                                      system32\DRIVERS\cposfw.sys
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6176
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\grpconv.exe
                                                                                                                                                                                                                                                                                                                                                                        grpconv -o
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7112
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc.exe"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                          PID:7140
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.exe"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                          PID:7072
                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7120
                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9E70B903-EFD5-4FD2-9EAD-480F97A67579} {D5B82A6F-AD40-41DC-9041-481DC8083844} 3824
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://redirect.zonealarm.com/redirect/route?oem=1&prod=21&mode=6&app=inclient&version=4.4.217.20710&lang=FR-FR&locale=&date=0&link_id=2&dest=try_buy_product&lic=&features=0
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7fff60afc188,0x7fff60afc194,0x7fff60afc1a0
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6736
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7338370933333460183,7232849626559338587,262144 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7888
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14001514661289988453,8200131152092387580,524288 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Time Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:7928
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,14775833532333256145,9476486365522051809,524288 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,10249645405820429159,9276041602527803974,2097152 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6316
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,8657997216065485197,14464366464613782367,2097152 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6880
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,17927697274564629722,11787774678804291199,2097152 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,18292670921010009324,7942375843878339427,2097152 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6640
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2892112160276411227,7509670499709161695,524288 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7244
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,8296161697928011406,13697045013864868663,524288 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10467479492876098440,11374624280586411253,524288 --field-trial-handle=2204,i,8881977711949079569,8269187771336033249,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7376
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff60afc188,0x7fff60afc194,0x7fff60afc1a0
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7228
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,2353224978735357058,904451554906010905,262144 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,14296995546457174031,2421214914839244590,524288 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Time Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,5509437798893757340,5147232567508553492,524288 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,13070849630984615404,12180292906257614552,524288 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7412
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,8176020528586500316,8024896467880046932,524288 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7180
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,13070849630984615404,12180292906257614552,524288 --field-trial-handle=2484,i,6113234324038522219,4556431640990605002,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\AV\ZA_WSC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\AV\ZA_WSC.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241187" str_field1="LicensingStartedTrial" str_field2="ZANG_FR_FW" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241187" str_field1="LicensingCheckStarted" str_field2="ZANG_FR_FW" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241187" str_field1="LicensingTrialValid" str_field2="ZANG_FR_FW" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241188" str_field1="LicensingCheckStarted" str_field2="ZANG_FR_FW" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241188" str_field1="LicensingValidLicense" str_field2="ZANG_FR_FW" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241190" str_field1="LicensingSuccessfulActivation" str_field2="ZANG_FW_FR" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241194" str_field1="UIFeatureToggle" str_field2="True" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="AntiBot" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241194" str_field1="UIFeatureToggle" str_field2="False" str_field3="False" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="AntiMalware" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241194" str_field1="UIFeatureToggle" str_field2="False" str_field3="False" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="AntiRansomware" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241194" str_field1="UIFeatureToggle" str_field2="True" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="Firewall" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241216" str_field1="UI<get_OpenFWCommand>b__285_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241221" str_field1="UI<get_OpenFWManageZonesPanelCommand>b__60_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241225" str_field1="UIOnLaunchEditZoneRule" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241233" str_field1="UIFW_OnGoBack" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241246" str_field1="LicensingCheckStarted" str_field2="ZANG_FW_FR" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211131" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241247" str_field1="LicensingValidLicense" str_field2="ZANG_FW_FR" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241254" str_field1="UI<OnShowUICompleteEvent>g__OpenWindowCommandExecuted|759_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241258" str_field1="UI<get_OpenFW_ViewProgramsPanelCommand>b__90_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6200
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241273" str_field1="UI<get_OpenFWSettingsCommand>b__62_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241277" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241281" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241282" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241282" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241284" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241290" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Internet" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241293" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Internet" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241293" str_field1="UIFeatureToggle" str_field2="False" str_field3="False" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="Firewall" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241295" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Internet" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241295" str_field1="UIFeatureToggle" str_field2="True" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="Firewall" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241297" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Internet" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241298" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211132" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241299" str_field1="UIFeatureToggle" str_field2="False" str_field3="True" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="FW_BladeModel.Security_Trusted" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241300" str_field1="UIFW_OnGoBack" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241318" str_field1="UI<get_OpenFW_ViewProgramsPanelCommand>b__90_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241321" str_field1="UI<OnShowUICompleteEvent>g__OpenWindowCommandExecuted|759_0" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241332" str_field1="UIOnOpenFWViewEvents" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241335" str_field1="UIOnDlgOk" str_field2="FirewallEventsViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241337" str_field1="UIOnOpenActivationDialog" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241344" str_field1="UIOnGoBack" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241358" str_field1="UILaunchPurchaseSubscriptionLink" str_field2="MainViewModel" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\dltel.exe" unique_client="0844E139D27CD74C83B5BAADCC7C5FA2" client_version="4.4.217.20710" type="211133" meta_data2="{OS_INFO}" int_field1="1" int_field2="1" int_field3="0" int_field8="1" int_field10="241365" str_field1="UI<get_RebootCommand>b__279_0" str_field2="<>c" str_field4="AM,AR,FW,WebSecure" str_field5="4.4.217.20710" str_field6="2026-10-03T16:49:57Z" str_field10="0844E139D27CD74C83B5BAADCC7C5FA2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\shutdown.exe" -r -f -t 0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\ZANG\Firewall\ZANG_DAF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Zonelabs\vsmon.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\Zonelabs\vsmon.exe -service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\drivers\vsdatant.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\drivers\vsdatant.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6310c728,0x7fff6310c734,0x7fff6310c740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,18204796281757247205,13405590411140545542,262144 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=1448 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,15419995309746540035,6980217744712751729,524288 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Time Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,505779753297350239,8049154433706814897,524288 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,235944378635173853,14600289060152544197,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,3783820983873797525,2282933264319413953,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4740,i,17332219214811123232,17847850093758178578,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,11818127923513959634,10995316890741795597,524288 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,4578912618081054344,4209565846139528101,524288 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,3317392001758194192,878477788891512977,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,17368900707277570530,10593123001490722258,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,14625714900070657361,1128842607878502445,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5956,i,18174317824254357332,14953401688718886349,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5924,i,7730459278556850185,790861633714316848,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6204,i,11752867949334022401,3652919217847922815,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6348,i,7755359328870913367,11895830227249433820,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5492,i,3215771508965156596,6746561445584311184,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6664,i,11999834599153641825,10020114206113225113,2097152 --field-trial-handle=2032,i,10589035303108093718,112564023227786775,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe" service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe" restart 2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\cpsechost.exe" service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe im "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\PplEtwForwarderManifest.man"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe im "C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\host\PplEtwForwarderManifest.man" /fromwow64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "LogonUI.exe" /flags:0x4 /state0:0xa3860055 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k CameraMonitor
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4832

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1059.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.015

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.015

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1518

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Security Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1518.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Time Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1124

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57c3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57c3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a93534c8afd369e5e4b64b6e49d576c5be17936ccde052eca16768e45a21c9d9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57ca.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57ca.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 685088474c9923d5214f96b8bd8e90ba7bc4299cac584dfaa8335de633a1da3c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57de.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57de.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 174KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b369dca3bfc074de72e0b33183b33f8355f52e4288a8f818f10cc4cc7526f048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57e3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57e3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 65fc7141f191d931fcfe8328bf8449e353dd618927fc9d87b894bad6b20498d7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57e5.rbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57e5.rbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 74d69fd486ac2b9b967bd9b4136f009f443515eeec4fa0c67b1d62ae5748f888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57e9.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57e9.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4eb0ef25aa891f7683f06c4990e537364f9d5c6607f6aefbab61107e1f12bc6d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57ec.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57ec.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6d2c7f8360b6de6d091f34c9fa944c3971c004b42e77d83180064d61eff0db4f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57f3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57f3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 17304d948b37c586ed7ffe41a3728ff65e8316b3bc944b762020b5770002ce20
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57fa.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b57fa.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7cccf708d8ba148339b3d06bce473168d2efab174ea17ce542b2f113f3d3a83e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b5801.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b5801.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4bab5764dea0666aa1032fc2c6487df5473d7915ac492024f6b63da48bc0e328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b5808.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b5808.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 129cb3af12d78f877380163abbb64647af01e7a7dc060a55a096a23d0d616033
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b581b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b581b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d9e9cbb68af0be2d598de057b18f33ab76561cc3aac0431d39984849ce8f23f3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b582e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b582e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 125e436ca70ce646f86e95f45eaef8749fa3c8c7197d90f73880804e635fdf82
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b5841.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b5841.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b4a5f095bcfc547f231a8c53c2d2720af41e0a2d605767deb38f4cde02674aa1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b5848.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b5848.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9ac4578a4e94c917cee6a174624555b8859383cf5840bcecef757512502a21c2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b585b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e5b585b.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 156eb8e32f51d1bef34f183059cfda55d008383b82f816b5ac786d03462b6ebc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  StorageMonitor.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\StorageMonitor.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 427KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3110d42de13be1c62e00ea9e62d7886ac0bd27a51714c09adff42eaa0a76c46b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  log4net.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\log4net.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 274KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 55369b3c94f14eaf0a274bbb497b3c19712562d0c063828dbd66da0cbb60d4cb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  EPNetUpdaterIPC.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Updater\Replace\EPNetUpdaterIPC.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 31KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b51d5361c0ef054176990f55c8820e897077b79f8152fdbea6ee5417eec08129
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  EPNetUtils.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Updater\Replace\EPNetUtils.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 382KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5a5e239049573e1cb869cd8f06f4a4c7652353eabfe257f104c1512a2cbfc117
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  AR_Service.InstallState
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\AR\AR_Service.InstallState
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1adb4f9d1d152e018246a0a2762b473d910906340207f57d3f8ce1097e1de09f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Newtonsoft.Json.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\AR\Newtonsoft.Json.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 683KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9000cfcb27d21ff1d9f7196b678ecc93be98af2a14254c03a554318891e6cb23
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_AR_MGR_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\AR\ZANG_AR_MGR_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 66465444f0b10ace72b3b9903a7a51423b10d12c3fd8c296a4f991a2aba0dbe1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_AV_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\AV\ZANG_AV_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 12600e0fd1fc7dd02f2ee730cdbc0c111e75198a11e61e57333be3729361e7a8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_MgrSvc_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\ZANG_MgrSvc_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6f408689327a9ba0a38f9ef5e8caf450e5355178c346b6aaf0d64d0cc86dcbb4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  zup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\MgrSvc\zup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1b359c86804d97b6eac5525be2c3611f57b16fb7505dc3d35819eb12ad8f6b30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CommonAssemblyLoader.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\CommonAssemblyLoader.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 11594a91caac5ab6bae02ebf5cbab95a3a5f84f9cfaafe9649ceb31c1c110d2d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CommonStore.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\CommonStore.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 54KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5a980332ae692b370a5b19f69d2d92c152951a17b6798ad004596dbd4224d3b9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DumpProc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\DumpProc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 392b924c2ee49bf33ba2049f7d0abed1cc95144558290189d00e967589d78072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  UI_Main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\UI_Main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 894KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ec721b66a28d48fdb8aec00f3f34219d86b41f3690e3c0042b655cfc9c94654a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_AssemblyLoader.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\ZANG_AssemblyLoader.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 db4588e002269a19509b7b622643d520639b057b26cacf77699ddffe269538e5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_UI_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\ZANG_UI_Uninstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ad9d804cfa5c0db94daa464c3d8c676dd95a1079acab76fdb68c7d4fb9b04168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dbghelp.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\CheckPoint\ZANG\UI\dbghelp.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2616c69bc2eab4c04ed378b1471a9466a7cd4de4947fbab30707fb66b04a38c3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmCrashHandler.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmCrashHandler.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 284KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2507c3624ac374a3c7f517d77d5f5d19eaf1d1db057c9f053de355e221897cc9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmCrashHandler64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmCrashHandler64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 359KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a0022d5a5f6f877085fb60d97b9832693855b152958f6a585d8caf64391cb4e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 166KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6cc44a16c922523c9ce47543c737e59dc48417d9bea590cf0562a35439071b58
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 175KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 750f32ab0830a0829b15f35854329537f6d321ebcdda28d687a21f654efbdf5f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmUpdateCore.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdateCore.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 589KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3a9a18f0eaed2a90166871bb94118d0f73edaf63692d084f877e700f94b73119
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZoneAlarmUpdateHelper.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\ZoneAlarmUpdateHelper.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 44KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6640aec86807db6781f6f312bcbd887461971a6784fa184a19cf10de79a7628a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdate.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdate.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7976c176947c8b8c5177ce467e7e8ed650c3a983e6a9d960a7850735387876ed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_am.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_am.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 af407c09e360ab707822cc462b89f802b11e64a154fc376f98bc16cd87d9c441
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ar.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ar.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e70c8407572a8d0c3b5a7295428982c9528b97824d740885c4e8e0ad447f5b04
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_bg.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_bg.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1c356e5fb727c97cc502a239d8d9ddfe4bf06b542f9baf183695c0543ed9342b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_bn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_bn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 432b3f12fbd4470020a30fba882687a4d9985f232d8516510142478c776dc794
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ca.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ca.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 76caac92c04b6cdc0ff402f23be39e36ab09a8364e0e38d8a637a4de5f1c9dab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_cs.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_cs.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 49KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0212cc735cf4f3cf429bbd9db22b294a63189ccf053c68f3f557f95733c80974
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_da.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_da.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 44e9e643c443cb723d07a35f76fbd53b6c15914ffb68ba6bbc4edbd7819271f2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_de.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_de.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6293c264c1e84559c8bd2ae66701c69e20e851cb9274b4ce058f4431e1b273fa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_el.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_el.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a5e1e6231181f33ac8f99c07d7783c3cc509fd54eed21bb30356cd3e4cc2426b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_en-GB.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_en-GB.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 55KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d938139976b77ad5c3437de59f2a7d42767fe7961f12c8fc32b4ea5442c9a0bd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_en.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_en.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 55KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 befb8405aa9ea11c4094c997ea46999d7fbdb86f117f35c5dcf39b365941bf74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_es-419.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_es-419.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 69ce98b10dd3feaa1a3da2599966b511aabb94aff9ade5ad77df30a7b06942b6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_es.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_es.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 66185dcb3c939c6846bbab7e7d9f1e461f86c7301ab70d771a5f21c66837496a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_et.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_et.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2e1866a0568e43a74685e20cc9da10bb06fe38177f76165c6f800f6066350a07
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_fa.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_fa.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c467850cf335635a812f1e0229c6726b460bca9cdd45c79ba5f83527b6b741fa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_fi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_fi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 236361d17f1e092bb39f97a75566fc414a8a949e8d0355e14b804e158bef9467
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_fil.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_fil.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b53fb05dbcd55212e562cc8e796dd81378f9a552b4844f786ed4c39860d006bb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_fr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_fr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 69701b8e4799a43233e91d2d58f5a12c2f5fa215b11bbfdd8de0526d6ae90e90
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_gu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_gu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5b61a13bf7e80206301ccd8a2c2c860a01a05033d2701386652cb785c59286fb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_hi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_hi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b7cb447c3739f2b13164f136c97c19e0d9f486d412bf689b4c5287a6c7893654
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_hr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_hr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 89e57e8a9345d986ba329b38717594ca50750e7f655ac05d8f0f35fcee2d3539
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_hu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_hu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6b46ecc560a11068bdc55b3036087af3cecdfd7a3b3ccb5f9e78eda7c00609e7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_id.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_id.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8c2dc70d50e47809ecf971f28995432bab895bfb617dc55627eef35375fc66b3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_is.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_is.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9491953ca633d708dbf7b8aa033b96d4ac5759d143705875d1dc73e65d9a1cd7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_it.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_it.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 abfbde19e5f97f4a4fdcfaaec2606447b721e3aa113c437da39f4c6053514f90
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_iw.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_iw.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 39KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3bc7b233b3b56abd22f1e67dbfec2e361e43e084246807d63d8fee683303d4ee
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ja.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ja.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 38KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 423064cb8f845283070bffd8fed252dbed8b369fe57da6e015ff73dcbe328e3f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_kn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_kn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e388e0a9960912fe518de424405c0166c830098cb973e26967f531e7265c0b8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ko.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ko.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 14babed0843bc1b2b33bcb1691e9e14051ce96497996d7392afd569f336efa6c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_lt.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_lt.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e591bbe78813668b5e6bcd817826893578715af51a91090337a785496e5d0a1d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_lv.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_lv.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e4458984081b07a6018c355298069d70070ecced2710c042dae9cdc9cd5fed83
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ml.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ml.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 44KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6a91e5a675b8d04d60bb8bb7c91b877b48de25e71786c93b21a344c62c6a797c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_mr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_mr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9b2ea9ae84cceebea8645b77614c3971b1c5db730906bf3cb1fa93cc1e19d284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ms.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ms.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e475472f6cd6f7ae37eafa19582a62e1cabd02fd453df539ccc53b854c3068fc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_nl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_nl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 de6b94f1e52db54dd707488de7e6dbdea484093d836b4b9ae73a74ce2e553e3f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_no.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_no.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5556eb6e4a4fbcfe3eb199b2a95564784bcabdcc3098a47a9908b475797348f2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_pl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_pl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 89d1b788d281cdfa3d309fedd182ff96de31b5d4c2fe885c0918c890bd28d4bc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_pt-BR.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_pt-BR.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b4d1deb7a8c8092975bf884cca7d94906af87988d875bceb79f42c18c5918060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_pt-PT.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_pt-PT.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 36669ae7674ad2df6149a6c6b24191634476dfedc6ce8e7c3c15fe54e89a3e19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ro.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ro.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9e18bc0d968ab105adeab1b22f31f113408b2aa099e5ae0a96e92d1b517abc8d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ru.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ru.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c6b4f2b4769e83c670dcd9c50b860157f4296513bcba25493356c83797182943
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_sk.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_sk.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c29ed129f392e5549d4cdf8e184cf25c92be2d8b77c24e5a708945e5a5905b31
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_sl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_sl.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4580143e0b695d364eaaca3a7301d11459d8bc971cff1190183082be8ee558d2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_sr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_sr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 85ba0463da83f3ef08be4573b1f4ed6a0812a6fb5f2cfce2e422361a7df1f942
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_sv.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_sv.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d85f21e071a47d94cb3a03e0036c5b045754b6dc7414b9591c1a6154dcab2c8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_sw.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_sw.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 25681da819880ed29d5c1b3a39299733dc7e956aad15f65723757c978c4f9aaf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ta.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ta.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cd60e9246e7ce69617270799e3f00d4fb17c6002f2c6a7e4186b9ded44ae6ef8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_te.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_te.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 43KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 432f6987edaa2bf9a02168ec04b01be19fae62d8d4c8e3685759d469c31db61d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_th.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_th.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 40KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e71a85573b3c74d3878bd4edf9d7b4768ad3d9f4e01e8d0171d39f44204b5b5c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_tr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_tr.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ddd090f039fb6ab461a19be017fd067533ab18b00c2f9ee056629c5db51c0414
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_uk.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_uk.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2390770e462e66e14bbd4fbffb52161e6b9cb433d67a0db8b0cc8c57de5891cb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_ur.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_ur.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f3da218554822d60f1b48f47278a1ff59d0af59ede70ebfcb45f7662bcaf3cca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_vi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_vi.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7046deac8c79c10e22256bd569ccce5d2ef2963aaadda5798fa4f7dffb6bed1c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_zh-CN.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_zh-CN.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 35KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a88e99430301d556dc3137ddf0ff7dff534e88d8c70cba231deebe038f48cb0d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  goopdateres_zh-TW.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files (x86)\GUM9A62.tmp\goopdateres_zh-TW.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 36KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e8f74ff397d7026b6b3dff77c94d4322db7a0370990251738bfa459bfd199e27
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  excel.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\DBStore\Events\graph\images\procs\excel.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 782fc5907dfb6740d3911b7d2d92af08df7e1ae6e155909f78efa228477b83a2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  publisher.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\DBStore\Events\graph\images\procs\publisher.svg
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 21cd253c41e62f0aadf3a80440d7c44caeb6ee0ccb7e874f72a5f48713c71bce
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  version.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\Endpoint Security\Anti-Malware\bases\savi\0\version.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 499B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a18830a224d5ab3a80c3bdb1f9ce58de5fb866fe3c168b37c7d92c78bdfca77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  zangitel.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\Logs\zangitel.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5bb107d0876d2e4a1809dd44cf750642568a42050e2493e62acea748aa3d6976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 951b60b313c8adc28131e3ef9c2ae66a3a7623d99b7638aed971e21144102bc2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d10881f94200e69f4bdc468d487d7cc4111c0fc975f7924d0898df5ddbdc7a0d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\Programs.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5328cd9fddb8d13f36f654f70f390b5b78da2d6c2c96c8f8d32a22df4dcf2f9b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 717d67d921c15c25e27c3e7a02cb0f92fdc726a49dfc4bcf53675193fb0c728c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3618b9f78536978d51b1721522649387d2eefc93f98642489428ff57934a4835
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 98b58b6fbbf4c2a941075b821b8306b86b29eff2068878a43807faf8cc2ab868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5428aeac197e81794a178c0a1cccc32533655c28d311c2cdeb96780f624b80b3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4593db79bf13ab48f4322f577255efe5c9a19f5dba9b0ae58a4cbaa4257c093c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d19d756e18fb7bed0f5a87170821291260dbbf16a16407da87f79743090fb43
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Licensing.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d65a649e160dd89dc9a335d4675b6e805480005afabddabe53413bd3c39d6a1c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 36KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 26e50808aa674159e7d8e3f49c7450668f76dfd0568ee336a7096113a4e36b18
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 44KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e434d3f515f9039cb6c35424c570dfa38e73f37a7f17a305d5d09c5044ce5d27
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3d5780a19f42233a25d8dc721719c3dfe3e7ffc76a2f14e8dca184251f57ac73
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 60KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 757d98389a10e7927ed32a37e6f34569dd565eb91c2a47c50a4a20b5fea2fe78
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 76KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 99c8b909e11e995e47a219fb372a753c433650f7c6d149e6ee65cce16dcab37b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 76KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b7f8b905120edff8cba9c0a03d5052930ff10c0e5feddd58ba79fe2d99841d6a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b93409cf5acf781abba2fa69ed29cad59b0b6b00377fa19ee66e987bd43e0fe5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 92KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f201f14014c69d659b98d592b50447ea4b0dd81db145130e36a23a866515b584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 100KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c7b2ebf79999d844f52bc48fe7e833dc0ee297bce63f064df5b762b75ad6bcbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 124KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e7585db69e8e68f515b4aa9298e71a8bcb17bfd026aa94ed88771a90938afbe3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\System\ZANG\Data\ZANG_Settings.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 124KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f49f87f8bc2d1ae69f39dad24d3f4c7fd1d8093e1cf796d19ea21b8caf1642d0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  AR_Service_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\AR\AR_Service_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 641B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 13347ddf0bb0dbbbf8f0f4077c40802ed692a9fd68df8b00260da8acb3b69719
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  AR_Service_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\AR\AR_Service_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 be86e2e2447ab9d1539f61ba6e104906fdbf0cbc990b2f5a2925894649f32002
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_AV_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\AV\ZANG_AV_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 626B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3ab51436838eac9bf738092610c171dc3406562fc4b466c1e4c3870548b55147
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_AV_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\AV\ZANG_AV_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 88b8bf0fa57a1d59b760eaecb1fd7f9b3641c8dfec16b47ae8f22c2f113fad8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4.4.217.20710-Install-Info.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\Install\4.4.217.20710-Install-Info.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 105KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 75178b54e8f24f17125fd078645abb3c962c9bce7619c433892060d7e4bb5181
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_MgrSvc_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\MgrSvc\ZANG_MgrSvc_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 666B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 866349023754aff707e218499064c9a4179dd045b5317d153472f7ab5135c059
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZANG_MgrSvc_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\MgrSvc\ZANG_MgrSvc_InstallUtil.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7c2c552dfc3b6f035db9b1df9f3590a1f46c777bbcb380cce98f1c75fea27027
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  VC11 Runtimes x86_repair.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\CheckPoint\ZANG\Logs\ZANG_Prerequisites\VC11 Runtimes x86_repair.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 33KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a7c83f24e693f65ba56eb3d722c7dc61a32f467fd17c5e3da121ca77ed900b5d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  state.rsm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 626B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8a385c06d3531ab4604baf89ec10a81680c97b0aa68c4be60201d4835d942324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  state.rsm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 622B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 46af06f48a9a0844cd2336c6f9ba8c59c41834ae3876987e3f73a6c26f51821b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15fd8b99-35b5-41aa-b92d-60b5a883e30d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\15fd8b99-35b5-41aa-b92d-60b5a883e30d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fe4802618ad88097dfeaaf5a0ef626b4285e94e97f111b5ba1e99be073632b09
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25be7086-61be-47c5-9e29-893844e6ef0d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\25be7086-61be-47c5-9e29-893844e6ef0d.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 70d9999a64d11bfd442379c1d6ded37e3442f7cf5bc1f133dde11ce1147a7342
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 40B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f9a21e220ce7232c95dad34f0ceb290496dbbf4d1fcc0f5e17911409f73cfcb4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  175e3b99-b0bb-4be4-8fa0-4b38f01246c7.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\175e3b99-b0bb-4be4-8fa0-4b38f01246c7.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29bb1855-a837-49e8-8417-e9dc74c7b96a.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29bb1855-a837-49e8-8417-e9dc74c7b96a.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ac5aba1726906fadca238e6bf1699bdf3f80459e8f49eb022de6b708e7446bbd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  79154ce2-4e46-411f-bbab-21a77deccbf6.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79154ce2-4e46-411f-bbab-21a77deccbf6.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6cfd3dc852bfb1185cf7a5608e9deb4fee2d8a28d41f8312423552de6de2df33
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 96B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 703a279e87582a6afbd6a90f2d57f1508f975c746220d9e4f5f05cd296897354
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data_1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 264KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1cb61801-c2d5-482a-9b73-5f181dda97e9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1cb61801-c2d5-482a-9b73-5f181dda97e9.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 469fd0a1f51c961987dab5ed21c3f705635acdff730326da00bb252399533b34
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4868aa88-be1f-434c-a52a-c141076a0838.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4868aa88-be1f-434c-a52a-c141076a0838.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 523B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 400b41f9b4f1a80a9fabc43653058459991fe841b9db1661bf4f91eb4fb828ae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  767ff4a1-1a94-4700-98d8-bdb2d4ec6a48.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\767ff4a1-1a94-4700-98d8-bdb2d4ec6a48.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 96B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 97add72b786d2d7e476e9a58f117ff01ab1c787479953cdc054e20de970e410c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9b1a6f438d8ddc469be921b1f73fbbce386236a76815dca59da3d7d0be180b39
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  018e44e0-5305-4d01-bbf1-7956f6c5ea4b.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\018e44e0-5305-4d01-bbf1-7956f6c5ea4b.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3660c9d5-2f3d-499f-bd1e-c434f2b3fee8.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3660c9d5-2f3d-499f-bd1e-c434f2b3fee8.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 70KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70d84108-b62f-49fa-8d01-8616b5b9e2ad.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70d84108-b62f-49fa-8d01-8616b5b9e2ad.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 425ecb10381622575d8059ab7091ee5fb22d7247dc79e885be8f712726ed05c1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data_0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 44KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ddb393319ff3606c0d9afcc8de279581e1e4d766c0df3f0df82e28968b2e2fa7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  data_1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 264KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 60aa4af3af57e6f7dc32b302478055bef94045c8ff57607538b1595043b0081a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d5f23b95861daab45728cb16c6dde929e7d814258bd9e536c7c6b1592c248576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2970182084bda2391fc0b2217ea9ccf4ffbd045f127956635573e098bd481ca6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a2949630-e38c-4356-bcd8-3194b1e2b2cd.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a2949630-e38c-4356-bcd8-3194b1e2b2cd.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66e1b449-f42b-4a8a-abbf-1618caccf00c.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66e1b449-f42b-4a8a-abbf-1618caccf00c.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b21530ccd82964ead493f170137aebf8e4c9ffdfed9b96fa757cb1e39352f14c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5723776-e6e0-4d04-a9ec-bf445683228e.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5723776-e6e0-4d04-a9ec-bf445683228e.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b9864c49934623136c871de6434e6cbd21dee78da3d279a376afbf86b60f38d5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dc400302-8a28-472d-a0cd-91108a13a784.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc400302-8a28-472d-a0cd-91108a13a784.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3abd133d97738af217761a7105f9b59e24dfe44373dd2c90fc263783d33eff55
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a976884a-6eb5-4328-a918-a3b5d2c5abf5.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a976884a-6eb5-4328-a918-a3b5d2c5abf5.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 13B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f16fcda3-508a-4aee-87a5-412b096c7ea0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f16fcda3-508a-4aee-87a5-412b096c7ea0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 42KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1ef7ebdd14f6c557784c01118b10396e94358724c0b193a1bb7ad9087c476d43
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Installer.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\Internet Logs\Installer.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 90KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 34b658df4908e662c6b369c1119a96c4c85f4a56a9bf6f927fb45139fb96fe3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  FindProcDLL.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\FindProcDLL.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  InstUtil.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\InstUtil.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 91ec7daf982d162533e5360c473ebe11b4109dafa7787b0dc2cdf9dbdaca9a77
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  StdUtils.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\StdUtils.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 100KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\System.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ZA_WSC_ExecVerifier.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\ZA_WSC_ExecVerifier.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 121KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f9b4b523c1618b79d701590ba376bb62ebb2b4c18fea41999cb1dcd2ba9562aa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  completed.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\completed.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 109KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9b4db80f22b68a9b036ac371e37a32a694a67fd4b01b5735fc8b65d0d3147ab8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\dltel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0fe3b131cfc8e0944cbfb4663fda605a2f553aeebbb964a683d64026163a9158
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icslta.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\icslta.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 742KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 aa72969df86d6c22ed4a46617d3438ad11d0407cc8d7f33a22e106bc3c591579
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  nsisunz.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\nsisunz.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 88KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c31b590cba443de87f0f4a81712f0883ac3b506f3868759d918d9a81f84ea922
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  zangitel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsc9F5F.tmp\zangitel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5f89f9489f93f2c5a1acc402901046f6ad3c71eb77f9391fb1d8d0eefff7b3f6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cposfw.inf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\cposfw.inf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 23648461523cb9760f7b3570f726a2f801dc89a329ff43a3ce97a7f1a5b2ae4b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  gatel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsq559.tmp\gatel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f5ee40ab0e03829d0e9d6ef5314aeed1a042e279d3df2e63b52fe5e5726ea770
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  INetC.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\INetC.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 25KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  VC12 Runtimes x64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  VC12 Runtimes x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\VC12 Runtimes x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nstC7F6.tmp\nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsyA1FF.tmp\System.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  linker.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsyA1FF.tmp\linker.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0503059d7fdcc3f9dc3d03fbd09b69005caaeb697d3ba1aadfd7be3af1f99874
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 54bf9f4bc4adcbba99aef3c048522c23822d3ddab51891dcba3b6f59192a2b28
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  logo.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 117KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  thm.wxl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  thm.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba2\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba2\license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 47KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba2\wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 126KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 148f262b214f5e472ba32db9824342bbda91d6f4c751a2da0bbc2b70e2794bd2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSI4AE.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSI4AE.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 94cdbd1b1cb924486a39bea5ab1c34460f60dda55df652a6bc458a25e679067e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSI8234.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSI8234.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 69c723e6655f4216bae78f2bbb039db06e8f96c46db794ec42ed859530a8ae10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSI8D43.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSI8D43.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3a872824a32e93254c2e71db21446c5c9001b272a51814d25c33348f46f5a557
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSIAED0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIAED0.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 165KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b1343c4128fc3f678216dd15e27c6b216ee82555e18d81f5aa55c747c0309b9c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSICAF.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSICAF.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6e9f2836f2f6b1f684b0a6b3b11807a3ed287c71863f38127500561bf6f7882f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MSIFD2A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIFD2A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 824KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7f78e80bad8588c716331baf0c961dd900413fbbae5f0ca40a97cd5a997820ca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5b57db.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\e5b57db.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 360KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 240a5a5d1d49539404784a640b940d803eaea472227ba26fa2a540eca6e85ed9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 47KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 198442bb6a9391c197bfa944e8261de5c658b5aa56b9cccdb6e93174e4ff7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 45KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9277d97ed455a8ae0285d9704e60a82b2fbce78946fb67ba04a1ad586eeb87c4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c27e3138afebc02cb0d42ce6563431c75dd9a513e18b1b893ace300294073e21
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fe27195386803cc2af82f0892c9304cf6d064eaaad9076cb767eca1da9b45a36
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7de05b5a255a95044a8585670f08605fc2d4ae3b60885181132b53266e5b56dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 14285aad9af48afa38b4e1d622604ead57104c30c921f0920f646447f569b9ae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3490d99706c23330391886168a9d2d8184dc4b18110b9ca116c36cda88610e1d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 40578094efcaa90339e90efa4f9e07bc9c6ae0e3898fff301f17313b296067d3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c18a641f0c3487a59d62a75af976e778be23e6be4a93507d2feda4c9fff2e780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 16c41ee55c71352f0eac10444402694e7834f2921f3fc98f8602078af326a24d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 96ec9e44f9d985fe8dac91c474f0600ee2a1544b11804983047bd112e59440a7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 eb8b260fd008d2a1704f458af5742f62924c76fd59c66c65af5687625c55eee3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\IAMDB.RDB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 251c9cb414a292b14e320f260f6d23b34ad46eb87af369778f2870cca64c59d6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  UEOYVALH.ldb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\UEOYVALH.ldb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f3d07ded620a8d74f7a73c65a9aed79f63f92572521ba89a30a45846c707199b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tvDebug.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Internet Logs\tvDebug.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 bf9df6d3199cae5593f81b58e0ab2f91b8240d69f57c73c495f5cf9b79ceb090
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  msvcp140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\Zonelabs\WscHelper\msvcp140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 429KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9c1dc36d319382e1501cdeaae36bad5b820ea84393ef6149e377d2fb2fc361a5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  msvcrt.cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\Zonelabs\WscHelper\msvcrt.cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 006bd20ad40547db9d53fb0ad4d5450de2e3e29e54bfaa76faf328b34cde1bae
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  vcruntime140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\Zonelabs\WscHelper\vcruntime140.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 81KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6823b98c3e922490a2f97f54862d32193900077e49f0360522b19e06e6da24b4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  config.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\Zonelabs\config.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 22KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a946f1194e193ebf48cdebab56c2928689db97a507d3566a2f419b896ee6439d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  atl110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\atl110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 160KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c7e81fce9d5f071361774f3755690a8cfefdcff714bc1debdb35066f64bccce0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  A71D57195A4A7F6218CA61D3102939D4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A71D57195A4A7F6218CA61D3102939D4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7fb0f58d71130abe724969f1cdc9b6a8d3274da18d059229b009a5b9b5557445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8809265003cc78cc7bfe708d0140f4045c86b2379b49b1b772eb25df1a27e1be
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110chs.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110chs.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 45KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b4f2c910e6e4197f20008db4f652dbcffc7e7b0eed0f8c8ba571de06c617de75
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110cht.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110cht.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 45KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 eb7d071593afb1c8d985096393687c8e6b00a2c47074d57b90678976ee0b1ad8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110deu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110deu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 73KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c4ab4a92c35084d268190fed624c632665d7395847b75f3ba364d85c5b4e5499
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110enu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110enu.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 63KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 bdb8a368842a9ca914b8dd26697907e8048d8dab5c567594abcd46c7677cbb8d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110esn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110esn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 72KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d87b87630c1b79ec9544240b82965bfd0faae65cbde02aff37a42e4d44e8041a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110fra.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110fra.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 73KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4caf47a2eb865dd75ce258ccfe62a8de804425a8616b8d8b0b43285554f26adb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110ita.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110ita.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 71KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2103cb2e7b03f7211b0c076d4d3b904ca61ded6231b67486293d516906bf804e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110jpn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110jpn.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 36b88d764caab40f9daebec20c472b765171af8ac8b22dd5fea32a65d854eb3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110kor.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110kor.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cb6d68392b52768668d1f77679f234f2e884bc0f0d31a6fb6f9291066368b589
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110rus.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110rus.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 69KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f41a5c4537d0a653d47b5939c72a0aa1fd0408e52dec9a67d2c891c8caad4f7a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfc110u.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfc110u.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 33f631c0b561199b5feb9020faa99e50efa9f421d7484ffa640c5561494726da
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfcm110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfcm110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 81KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fefdf1d62ecd884bb30a177961bdf1f40d46a984d0a6dc9de765db4725d0e1d2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  mfcm110u.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\mfcm110u.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 81KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7ac7a362646a8c8f7fa9b76086d93c876ebbb4085dd2ab1834b34f6bd5ef7223
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  msvcp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\msvcp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 522KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  msvcr110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\msvcr110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 854KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  vcamp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\vcamp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 313KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d46f958fe08fcd31f87f34c17a752fc148ffc9a1ec062522cb5712c56a96aa37
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  vccorlib110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\vccorlib110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 246KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0f4a9f6976c0b7fb34e362cc5220b70da32d3420771fbfcac70981da3b505d08
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  vcomp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SysWOW64\vcomp110.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 122KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 225a40104f94dc247ea62de47f600eac74c7c6b1f5964aeebeac2670e2eea878
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  vsdatant.inf_amd64_4cea0a7059680dca.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\System32\DriverStore\FileRepository\vsdatant.inf_amd64_4cea0a7059680dca.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 421B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8d630d9e54bf170ccf2bb9b6b70642ab34a5bc5a6aa28595e7909ef3de3dd62d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CPEPMon.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\System32\drivers\CPEPMon.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 198KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d4f8e3527755cf8e02cd1b84d88af7f79e69bd29a67ae4266c0512f15cb0bfec
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cpbak.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\System32\drivers\cpbak.sys
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 85KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2dee441625f514f5ae49be67f46d73885429bf38c0a58160c82d469deae1a598
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd_vcredist_x86_0_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\dd_vcredist_x86_0_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 185KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c5c5c4739fc8527f45eba7995f60321fe91d822f73261a362c9b98852a5b4fe8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd_vcredist_x86_1_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\dd_vcredist_x86_1_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 335KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d694b1aabcc5e254c38ffa7a73e7a72a9b3170ac21f3d868db29178fcdb77875
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6511-0x0000000008E20000-0x0000000008E84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6509-0x0000000008B80000-0x0000000008B88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6281-0x0000000008080000-0x0000000008130000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6512-0x0000000008BA0000-0x0000000008BA8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6283-0x0000000008040000-0x0000000008062000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6268-0x0000000007630000-0x0000000007662000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6510-0x0000000008B90000-0x0000000008B98000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1168-6454-0x00000000081E0000-0x00000000081F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1512-7147-0x0000000004950000-0x0000000004F68000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1512-7148-0x00000000043B0000-0x00000000043BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1512-7149-0x0000000004710000-0x000000000481A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1592-5268-0x0000000002960000-0x000000000296A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1980-7730-0x00000000005F0000-0x000000000063A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3220-6272-0x0000000007130000-0x0000000007140000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2929-0x0000000005330000-0x0000000005338000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2974-0x0000000005930000-0x000000000596C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2973-0x0000000005830000-0x0000000005842000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2932-0x0000000005740000-0x000000000574A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2931-0x0000000005340000-0x000000000534A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2928-0x0000000005280000-0x000000000529A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3484-2926-0x0000000000980000-0x000000000098C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4452-6711-0x0000000006EF0000-0x0000000006F32000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4488-1486-0x0000000002E40000-0x0000000002E48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4488-1501-0x0000000005900000-0x0000000005992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4488-1500-0x0000000005E20000-0x00000000063DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4488-1482-0x0000000005450000-0x00000000054FE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4488-1479-0x0000000000A20000-0x0000000000A48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1491-0x0000000005680000-0x0000000005688000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1483-0x00000000056E0000-0x0000000005744000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1502-0x0000000005E40000-0x0000000005E4E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1485-0x0000000005750000-0x0000000005796000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1481-0x0000000003030000-0x0000000003038000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1478-0x0000000000D40000-0x0000000000D4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4684-1480-0x0000000003040000-0x0000000003062000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4956-1484-0x0000000002FE0000-0x00000000030B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6058-0x0000000009D50000-0x0000000009D58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6006-0x0000000005DE0000-0x0000000005E02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6007-0x0000000005DC0000-0x0000000005DCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6045-0x0000000008920000-0x0000000008942000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6008-0x0000000005E30000-0x0000000005E48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6009-0x0000000006B20000-0x0000000006BCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6046-0x0000000008A10000-0x0000000008A22000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6047-0x0000000009670000-0x0000000009686000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6048-0x00000000096C0000-0x00000000096DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6049-0x0000000009750000-0x0000000009782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6010-0x0000000006BD0000-0x0000000006C28000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6011-0x0000000006D30000-0x0000000006D86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6012-0x0000000007030000-0x000000000704E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6050-0x0000000009910000-0x0000000009926000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6620-0x00000000106E0000-0x0000000010846000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6621-0x000000000D890000-0x000000000D898000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6622-0x000000000DEA0000-0x000000000DEA8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6052-0x000000000A4C0000-0x000000000A4CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6013-0x00000000070C0000-0x00000000070EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6014-0x00000000070F0000-0x000000000711C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6053-0x000000000B060000-0x000000000B092000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6054-0x000000000B050000-0x000000000B060000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6055-0x000000000B110000-0x000000000B176000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6056-0x000000000B2D0000-0x000000000B316000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6018-0x00000000074C0000-0x00000000074F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6020-0x0000000007620000-0x000000000762E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6057-0x000000000B340000-0x000000000B360000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6043-0x0000000008550000-0x00000000088AB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6044-0x00000000088B0000-0x00000000088FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-5988-0x0000000000D30000-0x0000000000E14000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6001-0x0000000005EB0000-0x0000000005FC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6059-0x000000000D8A0000-0x000000000D8DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6060-0x000000000B330000-0x000000000B33E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6024-0x0000000007A50000-0x0000000007B52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6005-0x00000000069D0000-0x0000000006A68000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5072-6042-0x0000000008470000-0x000000000848C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6420-3464-0x0000000004E30000-0x0000000004E38000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6644-5520-0x00000000033A0000-0x00000000033B6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-4014-0x00000000053F0000-0x000000000574B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-4099-0x00000000057E0000-0x0000000005802000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-4098-0x0000000006420000-0x000000000645C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-4021-0x0000000005750000-0x000000000579C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-4442-0x000000006ED70000-0x000000006EE46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3833-0x0000000004CB0000-0x0000000004D5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-5227-0x000000006ED70000-0x000000006EE46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3989-0x0000000005390000-0x00000000053F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3976-0x0000000005310000-0x0000000005326000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3971-0x0000000004C80000-0x0000000004C88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3928-0x0000000004C60000-0x0000000004C70000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7072-3868-0x0000000004C00000-0x0000000004C16000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3281-0x0000000004C50000-0x0000000004C62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3088-0x0000000000A10000-0x0000000000A18000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3089-0x0000000000A20000-0x0000000000A2A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3091-0x0000000002350000-0x000000000235E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3095-0x0000000004BE0000-0x0000000004C24000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3214-0x0000000002380000-0x000000000238E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3215-0x0000000004B90000-0x0000000004BA8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3221-0x00000000023A0000-0x00000000023B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3278-0x0000000004BC0000-0x0000000004BCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3516-0x0000000004FC0000-0x0000000004FDE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3530-0x0000000004FA0000-0x0000000004FAA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3549-0x0000000005000000-0x0000000005020000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3550-0x0000000005050000-0x000000000507A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3551-0x0000000005180000-0x00000000051AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/7140-3567-0x0000000005020000-0x0000000005040000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download