%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\~mcsAgentData.xml.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\mcsAgentData.xml
file renamed
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Config\~Config.xml.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Config\Config.xml
file renamed
HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Heartbeat\Application\\dummy
new registry key parameter created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\~referencePolicy.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\referencePolicy
file renamed
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\~referencePolicyRevisionId.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\referencePolicyRevisionId
file renamed
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\~referencePolicyCscResult.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\MCS\referencePolicyCscResult
file renamed
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\HMPA\~State.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\HMPA\State
file renamed
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Remote Management System\ManagementAgent\Adapters\ALC
new registry key created
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Remote Management System\ManagementAgent\Adapters\ALC\\DLLPath
new registry key parameter created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Diagnostic Utility\Sophos Diagnostic Utility.lnk
new file created
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Remote Management System\ManagementAgent\Adapters\SDU
new registry key created
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Remote Management System\ManagementAgent\Adapters\SDU\\DllPath
new registry key parameter created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.cs-cz.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.de-de.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.en-us.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.es-es.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.fr-fr.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.it-it.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.ja-jp.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.ko-kr.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.pl-pl.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.pt-br.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.zh-cn.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Events\Events.zh-tw.json
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\NLog.config
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\NLog.dll
new file created
%PROGRAMFILES(X64)%\Sophos\Sophos UI\Sophos UI.exe.config
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\~ophos Endpoint Agent.tmp
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk
file renamed
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Logs\McsAgent.1.log
file renamed
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Logs\McsAgent.log
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\EFW\~status.tmp
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\EFW\status
file renamed
%SystemDrive%\Config.Msi\63746.rbf
file moved
%SystemDrive%\Config.Msi\63747.rbf
new file created
%SystemDrive%\Config.Msi\63747.rbf
file moved
%SystemDrive%\Config.Msi\63748.rbf
new file created
%SystemDrive%\Config.Msi\63748.rbf
file moved
%SystemDrive%\Config.Msi\63732.rbf
new file created
%SystemDrive%\Config.Msi\63732.rbf
file moved
%SystemDrive%\Config.Msi\63734.rbf
new file created
%SystemDrive%\Config.Msi\63734.rbf
file moved
%SystemDrive%\Config.Msi\63739.rbf
new file created
%SystemDrive%\Config.Msi\63739.rbf
file moved
%SystemDrive%\Config.Msi\6373b.rbf
new file created
%SystemDrive%\Config.Msi\6373b.rbf
file moved
%SystemDrive%\Config.Msi\6373f.rbf
new file created
%SystemDrive%\Config.Msi\6373f.rbf
file moved
%SystemDrive%\Config.Msi\63741.rbf
new file created
%SystemDrive%\Config.Msi\63741.rbf
file moved
%SystemDrive%\Config.Msi\63745.rbf
new file created
%SystemDrive%\Config.Msi\63745.rbf
file moved
%SystemDrive%\Config.Msi\63746.rbf
new file created
HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Sophos UI\AdapterNotifications\SAV\\LastUIScanTime
new registry key parameter created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210205204235-003e-event-SAV.xml
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205205314
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210205211958-003f-status-UC.xml
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205212316
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205215320
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF67840.TMP
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205222324
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF67840.TMP
file renamed
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210205224210-0040-status-UC.xml
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF6784f.TMP
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205225326
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF6784f.TMP
file renamed
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205232332
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF6785f.TMP
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210205235342
new file created
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Endpoint Agent.lnk~RF6785f.TMP
file renamed
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210206002343-0041-status-UC.xml
new file created
%SystemDrive%\Config.Msi\63749.rbf
new file created
%ALLUSERSPROFILE%\HitmanPro.Alert\policy_20210206002344
new file created
%SystemDrive%\Config.Msi\63749.rbf
file moved
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service\CloudSubscriptions\Base\\FixedVersion
new registry key parameter created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210124155703-0012-status-UI.xml
new file created
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service\CloudSubscriptions\CloudAV\\FixedVersion
new registry key parameter created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210124155704-0013-status-SHS.xml
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\mcsAgentData.xml~RFed4d34e.TMP
new file created
(x32)HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service\CloudSubscriptions\HitmanProAlert\\FixedVersion
new registry key parameter created
%SystemDrive%\Config.Msi\6374d.rbs
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\mcsAgentData.xml~RFed4d34e.TMP
file renamed
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\ALC\~SAUPolicy.tmp
new file created
%SystemDrive%\Config.Msi\6374e.rbf
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Config\Config.xml~RFed4d38c.TMP
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\ALC\SAUPolicy~RF4c4667c.TMP
new file created
%SystemDrive%\Config.Msi\6374e.rbf
file moved
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Config\Config.xml~RFed4d38c.TMP
file renamed
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\ALC\SAUPolicy~RF4c4667c.TMP
file renamed
%SystemDrive%\Config.Msi\63750.rbf
new file created
%ALLUSERSPROFILE%\Sophos\Management Communications System\Endpoint\Persist\20210205123528-0000-status-ALC.xml
new file created
%ALLUSERSPROFILE%\Sophos\Remote Management System\3\Agent\AdapterStorage\ALC\SAUPolicy
file renamed
%SystemDrive%\Config.Msi\63750.rbf
file moved