Analysis Report SophosSetup (9).exe

Overview

General Information

Sample Name: SophosSetup (9).exe
Analysis ID: 413056
MD5: 070002b28e379e0c362f0e69ecd6d60b
SHA1: db19c547d7231362040c8ff10c92451e059c3ef2
SHA256: c92892ee1c9a44469650f5575e64c11fa08f44bcdf61c49e19a2714e2b6a7f5b
Infos:

Most interesting Screenshot:

Detection

Score: 10
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Compliance

Score: 48
Range: 0 - 100

Signatures

AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0022403A __EH_prolog3_GS,__EH_prolog3_GS,CryptAcquireContextW,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,GetLastError, 3_2_0022403A
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00224721 __EH_prolog3_GS,CryptAcquireContextW,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,GetLastError, 3_2_00224721
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001C64CB CryptAcquireContextW,CryptCreateHash, 3_2_001C64CB
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00224336 __EH_prolog3_GS,CryptCreateHash,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,GetLastError, 3_2_00224336
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00224D4A __EH_prolog3_GS,CryptStringToBinaryA,CryptStringToBinaryA,CertCreateCertificateContext, 3_2_00224D4A
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00224EAF __EH_prolog3_catch_GS,CryptImportPublicKeyInfo,___std_reverse_trivially_swappable_1,CryptVerifySignatureW,CryptDestroyKey,CryptDestroyKey, 3_2_00224EAF

Compliance:

barindex
Uses 32bit PE files
Source: SophosSetup (9).exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Creates install or setup log file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log Jump to behavior
PE / OLE file has a valid certificate
Source: SophosSetup (9).exe Static PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: SophosSetup (9).exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Binary contains paths to debug symbols
Source: Binary string: C:\workspace\_bin\Win32\Release\SafeLauncher.pdb source: SophosSetup (9).exe
Source: Binary string: su-setup32.pdb source: su-setup32.exe.1.dr
Source: Binary string: C:\workspace\_bin\Win32\Release\Build\SophosSetup_Stage2.pdb source: SophosSetup_Stage2.exe, 00000003.00000000.251883081.00000000002B6000.00000002.00020000.sdmp
Source: Binary string: C:\workspace\_bin\Win32\Release\Setup.pdb source: SophosSetup (9).exe
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0025DDDA FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError, 3_2_0025DDDA
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00227B7C __EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,GetLastError,std::bad_exception::bad_exception, 3_2_00227B7C

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 2.20.142.209 2.20.142.209
Source: SophosSetup (9).exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SophosSetup (9).exe String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: SophosSetup (9).exe String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: SophosSetup (9).exe String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Setup.exe, 00000001.00000003.371875155.0000000006C92000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crl.sca1b.amazontrust.com/sca1b.crl0
Source: SophosSetup (9).exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SophosSetup (9).exe String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SophosSetup (9).exe String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: SophosSetup (9).exe String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SophosSetup (9).exe String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SophosSetup (9).exe String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SophosSetup (9).exe String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: SophosSetup (9).exe String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://crt.sca1b.amazontrust.com/sca1b.crt0
Source: SophosSetup_Stage2.exe, 00000003.00000003.268255906.0000000003609000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.d
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.dgMf
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.f
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.fg
Source: SophosSetup_Stage2.exe, 00000003.00000002.523131239.0000000008CE0000.00000004.00000001.sdmp String found in binary or memory: http://d1.so
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sop
Source: 5924-288-623597599.3.dr, 5924-453-466002726.3.dr String found in binary or memory: http://d1.sophosupd.com/update
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update#
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update%
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update&
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update(
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update-
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/3
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/G
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/L
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/M
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/b
Source: SophosSetup_Stage2.exe, 00000003.00000003.462183778.0000000008CBE000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/23328ca26b48315160a9396b8040b929x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000003.462183778.0000000008CBE000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/23328ca26b48315160a9396b8040b929x000.xml.zipp
Source: SophosSetup_Stage2.exe, 00000003.00000002.522283652.0000000008909000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/45a55ba22458d1356e4591b7947b60a5x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.523131239.0000000008CE0000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/760ef3e9d6ea1676c85157afb1a1a28ex000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.523131239.0000000008CE0000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/760ef3e9d6ea1676c85157afb1a1a28ex000.xml.zip857029
Source: SophosSetup_Stage2.exe, 00000003.00000002.523131239.0000000008CE0000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/760ef3e9d6ea1676c85157afb1a1a28ex000.xml.zipg593ec075cddab23
Source: SophosSetup_Stage2.exe, 00000003.00000002.523062288.0000000008C51000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zip.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zipg
Source: SophosSetup_Stage2.exe, 00000003.00000002.523062288.0000000008C51000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zips
Source: SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.ziptF&
Source: SophosSetup_Stage2.exe, 00000003.00000002.522244778.00000000088D0000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/af0fcb7a770e7073c11452e908f303f3x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/bulk/dat/e5a486c97647bb814dfc5555e1d4f4bcx000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update/w
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update0
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update0p
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update1#
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update4
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update5
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update58B:
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update6
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update7
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update8
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update:
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update;
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update=
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update?C
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateA
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateG
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateK
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateL
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateN
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateO
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateR
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateS
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateZ
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update_
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatea
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updated
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatee2B
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateey
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateg
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateh
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatei
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateio
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatej
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatek
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatem
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateo
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateq
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updates
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatet
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updateu
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatew
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/updatey
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.com/update~8
Source: 5924-288-623597599.3.dr, 5924-453-466002726.3.dr String found in binary or memory: http://d1.sophosupd.net/update
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update$
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update%
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update)
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update0
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update1J
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update3
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update5
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update6
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update8
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update9
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update:d
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update?
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateA
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateCa
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateD
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateE
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateE-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateF5
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateG
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateG#
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateH
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateK
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateL
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateM
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateM3
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateP
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateU
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateX
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateZ
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/update_C
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatea
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updated
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatedy
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatef&
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatef(
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateg
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateh
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatei
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatej
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatek
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatel
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatem
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updater
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updates
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatet
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatetH
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updateu
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatew
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatex
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d1.sophosupd.net/updatey
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d2.d
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d2.dg
Source: SophosSetup_Stage2.exe, 00000003.00000002.522307237.0000000008911000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosq7
Source: SophosCloudInstaller_20210513_141305.log.3.dr, 5924-148-844808410.3.dr, 5924-969-1700195119.3.dr, 5924-288-623597599.3.dr String found in binary or memory: http://d2.sophosupd.com/update
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update#
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update(
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update-
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update/
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update4
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update:
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update?
Source: SophosSetup_Stage2.exe, 00000003.00000002.521172487.00000000085F6000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updateE
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updateP
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updateQ
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update_
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatec
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatef
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updateh
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatek
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updates
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatet
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatetW
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/updatev
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update~
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.com/update~w
Source: SophosSetup_Stage2.exe, 00000003.00000003.490922153.000000000869C000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.ne
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp, 5924-983-240413927.3.dr, 5924-981-1772126667.3.dr, 5924-971-763910062.3.dr, 5924-350-929947901.3.dr, 5924-526-1804040769.3.dr, 5924-975-1110205940.3.dr, 5924-377-1796768071.3.dr, 5924-150-949740749.3.dr, 5924-991-579746244.3.dr, 5924-993-977095868.3.dr, 5924-977-766237140.3.dr, 5924-352-1455969333.3.dr, 5924-979-1940500613.3.dr, 5924-292-1916544094.3.dr, 5924-152-29538948.3.dr, 5924-985-1531050405.3.dr, 5924-380-789700688.3.dr, 5924-973-1496857875.3.dr, 5924-148-844808410.3.dr, 5924-969-1700195119.3.dr, 5924-288-623597599.3.dr String found in binary or memory: http://d2.sophosupd.net/update
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update(
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update0
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update3
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update6
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update?
Source: SophosSetup_Stage2.exe, 00000003.00000003.368957812.000000000814E000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updateF
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updateJ
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updateM
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updateO
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update_
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updated
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatek
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatep
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatepl
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatew
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/updatex
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d2.sophosupd.net/update~
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.s
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.soph
Source: 5924-453-466002726.3.dr String found in binary or memory: http://d3.sophosupd.com/update
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update#
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update$
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update%
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update&$/
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update)
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update-
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/0
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/4
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/N
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/i
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update/u
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update1
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update3
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update4
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update4/
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update7
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update7)
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update708
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update:
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update;
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update;.
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update=
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update?
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateB
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateC$
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateF
Source: SophosSetup_Stage2.exe, 00000003.00000003.368957812.000000000814E000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateI
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateL
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateO
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateP
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateR)
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateR2
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateS
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateU
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateV
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateW
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateX
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateY
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateY(
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update_
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateb%
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatec
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updated
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatee3
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateer
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatef
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatej
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatek-
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateq
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updates
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatet
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatetl
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateu
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updateu6~
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatev
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatev&
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatex
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatez
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/updatez(
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.com/update~
Source: 5924-453-466002726.3.dr String found in binary or memory: http://d3.sophosupd.net/update
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update#7$
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update%
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update&
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update)&
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update)7
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update019
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update2O
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update2R
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update4
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update6
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update7
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update8&
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update9
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update=
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update?
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update?6
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateA5
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateC
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateE
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateE(
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateF)
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateGg
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateJ
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateJ%
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateK6L
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateL
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateN
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateRe
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateS
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateVR
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateW
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateX)
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateY
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update_
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update_(
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/update_-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatea
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateb
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateb1k
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatec
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatec6d
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updated
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatedd
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatedz
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatee
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatef
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateg
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatej
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatek
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatel
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatep
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updater
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updates
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatet
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatet?
Source: SophosSetup_Stage2.exe, 00000003.00000003.368957812.000000000814E000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatetb
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updateu
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatev
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatev7
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatew
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp String found in binary or memory: http://d3.sophosupd.net/updatey
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://dci.sophosupd.com/cloudupdate
Source: SophosCloudInstaller_20210513_141305.log.3.dr String found in binary or memory: http://dci.sophosupd.com/update
Source: SophosSetup_Stage2.exe String found in binary or memory: http://dci.sophosupd.net/update
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://dci.sophosupd.net/update&
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://es-web.sophos.com/update
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://o.ss2.us/0
Source: Setup.exe, 00000001.00000002.509902839.0000000004D52000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.dig
Source: SophosSetup (9).exe String found in binary or memory: http://ocsp.digicert.com0C
Source: SophosSetup (9).exe String found in binary or memory: http://ocsp.digicert.com0H
Source: SophosSetup (9).exe String found in binary or memory: http://ocsp.digicert.com0I
Source: SophosSetup (9).exe String found in binary or memory: http://ocsp.digicert.com0O
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: Setup.exe, 00000001.00000003.371875155.0000000006C92000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sca1b.amazontrust.com06
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://s.ss2.us/r.crl0
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: Setup.exe, 00000001.00000002.510327434.000000000504B000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.256764628.0000000007AEF000.00000004.00000001.sdmp, su-setup32.exe.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: SophosSetup (9).exe String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SophosSetup (9).exe String found in binary or memory: http://www.emtype.nethttp://www.emtype.net/emtype_eula.phpSophos
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: http://www.sophos.com/EE/AUConfig
Source: SophosSetup_Stage2.exe String found in binary or memory: http://www.sophos.com/EE/AUEvent
Source: SophosSetup_Stage2.exe String found in binary or memory: http://www.sophos.com/EntityInfo
Source: SophosSetup_Stage2.exe, SophosSetup_Stage2.exe, 00000003.00000000.251883081.00000000002B6000.00000002.00020000.sdmp String found in binary or memory: http://www.sophos.com/xml/mansys/AutoUpdateStatus.xsd
Source: SophosSetup_Stage2.exe, 00000003.00000003.275503868.000000000815C000.00000004.00000001.sdmp String found in binary or memory: http://www.sophos.com/xml/mcs/computerstatuQzj
Source: SophosSetup_Stage2.exe, SophosSetup_Stage2.exe, 00000003.00000003.275594694.0000000008193000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.275503868.000000000815C000.00000004.00000001.sdmp String found in binary or memory: http://www.sophos.com/xml/mcs/computerstatus
Source: SophosSetup_Stage2.exe String found in binary or memory: http://www.sophos.com/xml/mcs/events
Source: SophosSetup_Stage2.exe, 00000003.00000003.268422128.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: http://www.sophos.com/xml/mcs/server
Source: SophosSetup_Stage2.exe, SophosSetup_Stage2.exe, 00000003.00000000.251883081.00000000002B6000.00000002.00020000.sdmp String found in binary or memory: http://www.sophos.com/xml/mcs/statuses
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: http://x.ss2.us/x.cer0&
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://community.sophos.com/
Source: SophosSetup_Stage2.exe, 00000003.00000003.373421713.000000000833A000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/
Source: SophosSetup_Stage2.exe, 00000003.00000003.462381234.0000000008DB5000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/23328ca26b48315160a9396b8040b929x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/45a55ba22458d1356e4591b7947b60a5x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000003.462242846.0000000008DCA000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.489774954.0000000008DF4000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/4c3736b66924280d3820b4f19b5333ecx000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/4c3736b66924280d3820b4f19b5333ecx000.xml.zipEu
Source: SophosSetup_Stage2.exe, 00000003.00000002.523131239.0000000008CE0000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/760ef3e9d6ea1676c85157afb1a1a28ex000.xml.zipip08X
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/7679ec3e648c5d4e6a3af50033e03e78x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.519636787.00000000080DE000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/9ff2b08239795e6bf5e302d6584b2060x000.xml.zipAwCt
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/a1bafe2624da97918bfe8cbcdd6c1d7cx000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/a1bafe2624da97918bfe8cbcdd6c1d7cx000.xml.zipHG
Source: SophosSetup_Stage2.exe, 00000003.00000002.523242822.0000000008DAC000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/af0fcb7a770e7073c11452e908f303f3x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/b0dfcd18663c307b5a964cdd8904d10fx000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/b0dfcd18663c307b5a964cdd8904d10fx000.xml.zipkt
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/b5dcb9b424bf7b7554ec626a04a34f69x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/b94b8f425d529bea7d942e7a8ef95772x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/cba3292f23292028503ce6605e1b36e2x000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/cba3292f23292028503ce6605e1b36e2x000.xml.zipca
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/e5a486c97647bb814dfc5555e1d4f4bcx000.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.521992072.0000000008659000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/dat/e5a486c97647bb814dfc5555e1d4f4bcx000.xml.zip3
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/sdds.APPFEED_d1.xml.zip4
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/sdds.CloudEnc_2-0-81.1.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/sdds.SAVCNTRL.xml.zipl
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/sdds.TELEMSUPP.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/bulk/sdds.sxl_supp.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/catalogue/sdds.APPFEED_d1.xmld
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/catalogue/sdds.CEPNG_2-18-2_10-8-10-3.1.xml
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/catalogue/sdds.CRTSUPP.xmll
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com/update/catalogue/sdds.SAVCNTRL.xml
Source: SophosSetup_Stage2.exe, 00000003.00000003.451767517.0000000008DC3000.00000004.00000001.sdmp String found in binary or memory: https://d1.sophosupd.com:443/update/bulk/dat/af0fcb7a770e7073c11452e908f303f3x000.xml.zipa770e7073c1
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d2.sophosupd.com/update/bulk/sdds.VDB_supp.xml.zipDy4
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d2.sophosupd.com/update/bulk/sdds.data0910.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp String found in binary or memory: https://d2.sophosupd.com/update/bulk/sdds.hips.xml.ziplr
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d2.sophosupd.com/update/catalogue/sdds.VDB_supp.xmlD
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d2.sophosupd.com/update/catalogue/sdds.data0910.xmlK
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d3.sophosupd.com/update/bulk/sdds.esh_rules.xml.zip
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://d3.sophosupd.com/update/catalogue/sdds.esh_rules.xml
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp String found in binary or memory: https://d3.sophosupd.com/update/catalogue/sdds.ixdata.xml
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://dci.sophosupd.com/update/4/38/4388aee5be81b68bbe0567d1a9bab7a6.dat
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://docs.sophos.com/esg/Sophos-Endpoint-Windows/help/zh-tw/index.html
Source: Setup.exe, 00000001.00000003.242570639.0000000002E9E000.00000004.00000001.sdmp String found in binary or memory: https://downloads.sophos.com/full/central/windows/business/installer/stage2-1.11.276.0-2ab0cad479824
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp String found in binary or memory: https://dzr-api-amzn-us-west-2-fa88.api-upe.p.hmr.sophos.com/api/download/stage2-details/c137cbf0-9e
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/-
Source: SophosSetup_Stage2.exe, 00000003.00000003.275503868.000000000815C000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/ress
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/sophos//
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/sophos/management/ep/install/co
Source: SophosSetup_Stage2.exe, 00000003.00000003.284661258.000000000818E000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/sophos/management/ep/install/coo
Source: SophosSetup_Stage2.exe, 00000003.00000003.284683752.0000000008184000.00000004.00000001.sdmp String found in binary or memory: https://dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com:443/sophos/management/ep/install/authentica
Source: SophosSetup_Stage2.exe, 00000003.00000003.268422128.00000000080F2000.00000004.00000001.sdmp String found in binary or memory: https://fsr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com/11dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sop
Source: SophosSetup_Stage2.exe, 00000003.00000000.251955937.0000000000326000.00000002.00020000.sdmp String found in binary or memory: https://support.sophos.com/support/s/article/KB-000036834
Source: SophosSetup_Stage2.exe, 00000003.00000000.251955937.0000000000326000.00000002.00020000.sdmp String found in binary or memory: https://support.sophos.com/support/s/article/KB-000036834?language=ja
Source: SophosSetup (9).exe String found in binary or memory: https://www.digicert.com/CPS0
Source: Setup.exe, 00000001.00000002.505763946.0000000002E83000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/de-de/legal.aspx
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/en-us/legal.aspx
Source: Setup.exe, 00000001.00000002.505696652.0000000002E6C000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/en-us/legal.aspx5
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/es-es/legal.aspx
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/fr-fr/legal.aspx
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/it-it/legal.aspx
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/ja-jp/legal.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/scde-zh-tw
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/scfe-zh-tw
Source: SophosSetup (9).exe String found in binary or memory: https://www.sophos.com/zh-cn/legal.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/zh-tw/legal.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/zh-tw/products/endpoint-antivirus.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/zh-tw/products/intercept-x.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/zh-tw/products/managed-threat-response.aspx
Source: SophosSetup_Stage2.exe, 00000003.00000003.489759979.0000000008DCA000.00000004.00000001.sdmp String found in binary or memory: https://www.sophos.com/zh-tw/products/server-security.aspx

E-Banking Fraud:

barindex
Drops certificate files (DER)
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crt Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crt Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca4.crl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca2.crl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca3.crt Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\Management Certs\sophosca1.crt Jump to dropped file
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0022403A __EH_prolog3_GS,__EH_prolog3_GS,CryptAcquireContextW,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,GetLastError, 3_2_0022403A
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00224721 __EH_prolog3_GS,CryptAcquireContextW,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,GetLastError, 3_2_00224721

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Process Stats: CPU usage > 98%
Detected potential crypto function
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00244392 3_2_00244392
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00218DA0 3_2_00218DA0
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001F9328 3_2_001F9328
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00255723 3_2_00255723
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00249810 3_2_00249810
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00201DA4 3_2_00201DA4
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001DE223 3_2_001DE223
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001EB45D 3_2_001EB45D
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0023FF50 3_2_0023FF50
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001C002D 3_2_001C002D
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_002540E6 3_2_002540E6
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_002581C1 3_2_002581C1
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0025C2B5 3_2_0025C2B5
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00280358 3_2_00280358
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00280478 3_2_00280478
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0026C4B0 3_2_0026C4B0
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0025C659 3_2_0025C659
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00274A76 3_2_00274A76
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0028CDE7 3_2_0028CDE7
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0027CF00 3_2_0027CF00
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00254F12 3_2_00254F12
Found potential string decryption / allocating functions
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 00260541 appears 44 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 00199638 appears 244 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 0019AD54 appears 37 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 002604D3 appears 310 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 0026050A appears 42 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 0019AAFE appears 414 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 0019A85A appears 40 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 0026049F appears 173 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 001941E7 appears 33 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 00260C50 appears 37 times
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: String function: 001987CC appears 39 times
Source: C:\Users\user\Desktop\SophosSetup (9).exe Code function: String function: 01361DE0 appears 40 times
PE file contains executable resources (Code or Archives)
Source: SophosSetup (9).exe Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
PE file contains strange resources
Source: SophosSetup (9).exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SophosSetup_Stage2.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: SophosSetup (9).exe, 00000000.00000000.234766043.0000000001395000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSetup.exeD vs SophosSetup (9).exe
Source: SophosSetup (9).exe, 00000000.00000000.234766043.0000000001395000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSophosSetup.exeD vs SophosSetup (9).exe
Source: SophosSetup (9).exe Binary or memory string: OriginalFilenameSetup.exeD vs SophosSetup (9).exe
Source: SophosSetup (9).exe Binary or memory string: OriginalFilenameSophosSetup.exeD vs SophosSetup (9).exe
Uses 32bit PE files
Source: SophosSetup (9).exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: classification engine Classification label: clean10.winEXE@5/1049@0/6
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00226F91 __EH_prolog3_GS,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 3_2_00226F91
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001D2210 __EH_prolog3_GS,GetWindowsDirectoryW,GetDiskFreeSpaceExW,GetLastError,GetLastError, 3_2_001D2210
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001E0180 __EH_prolog3_catch_GS,CoCreateInstance,CoSetProxyBlanket, 3_2_001E0180
Source: C:\Users\user\Desktop\SophosSetup (9).exe Code function: 0_2_01361260 HeapReAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,FindResourceW,LoadResource,LockResource,SizeofResource,CreateFileW,WriteFile,CloseHandle,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapAlloc,GetStartupInfoW,CreateProcessW,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,CloseHandle,HeapFree,HeapFree, 0_2_01361260
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001C8A6D __EH_prolog3,StartServiceW,GetLastError, 3_2_001C8A6D
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Mutant created: \Sessions\1\BaseNamedObjects\com.sophos.cloud.single
Source: C:\Users\user\Desktop\SophosSetup (9).exe File created: C:\Users\user~1\AppData\Local\Temp\sfl-0719c400 Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: INFO 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: INFO 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: --- 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: --- 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: INSTALLER 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: CommandLine 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: `|, 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: `|, 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: `|, 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: `|, 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Unrecognised 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Cancelled 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Failed 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: PrecheckFailed 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Succeeded 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Unrecognised 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Mandatory 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: Suggested 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: NotRequired 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: RebootResult 3_2_00196348
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Command line argument: 8~, 3_2_00196348
Source: SophosSetup (9).exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SophosSetup (9).exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/flags/endpoint/
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/register
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/statuses/endpoint/
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/authenticate/endpoint/
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/deployment-info/3
Source: SophosSetup_Stage2.exe String found in binary or memory: --install
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/commands/applications/APPSPROXY;
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/commands/endpoint/
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/policy/application/
Source: SophosSetup_Stage2.exe String found in binary or memory: sophos/management/ep/install/events/endpoint/
Source: SophosSetup (9).exe String found in binary or memory: #\.\.\. (\w+) ([A-Za-z0-9/+=]+)\n#sig (\w+) ([A-Za-z0-9/+=]+)\ncert[BADSIG]: [BADFILE]: : '[VE_BADCERT]: Running setup.SetHandleInformation failed: CreatePipe failed: ReadFile failed: Failed to run setup program. CreateProcess failed: )Unexpected bytes_read failed: Unexpected size field value: (expected Failed to retrieve the exit code for the Setup programFailed to retrieve the exit code for the Setup program! Error code (for GetExitCodeProcess): Setup program failed with code: No value was provided for --customertokenNo value was provided for --epinstallerserver No value was provided for --productsNon string value provided for Content-Typeapplication/json; charset=utf-8Failed to get stage-2 infoapi/download/stage2-details/Failed to get stage-2 info: . Status code: stage1_version1.10.305.0Parsing message received for Stage 2 filename: 'processor_architectureJson content was :Error parsing json file for Stage 2 filename: mcs_serverstage2_filenamedeprecated_stage_1errorFailed to get stage 2 details: Stage 2 details suggest an expired Stage was used.Failed to get stage 2 details: Unrecognised or insufficient content.application/gzipdownloads.sophos.comfull/central/windows/business/installer/AcceptFailed to download stage-2 archive. Status code: 404 error indicating potentially expired stage 1Failed to download stage-2 archive: ReOpenFile failed (intermediate_handle): Extracting files:ReOpenFile failed (new_handle): Extraction failure.Failed to read long filename.Extraction failureMissing file after long filename.failed to read long filenameFailed to open file.Missing file after long filenameCan't write to file.Failed to open filecan't write to file\"
Source: SophosSetup (9).exe String found in binary or memory: "setup.failure.launch": "Failed to run the system pre-installation checks.",
Source: SophosSetup (9).exe String found in binary or memory: "setup.progress.running_prechecks": "Pre-installation checks...",
Source: SophosSetup (9).exe String found in binary or memory: stato possibile effettuare i controlli pre-installazione.",
Source: SophosSetup (9).exe String found in binary or memory: "setup.progress.running_prechecks": "Controlli pre-installazione...",
Source: unknown Process created: C:\Users\user\Desktop\SophosSetup (9).exe 'C:\Users\user\Desktop\SophosSetup (9).exe'
Source: C:\Users\user\Desktop\SophosSetup (9).exe Process created: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe 'C:\Users\user~1\AppData\Local\Temp\sfl-0719c400\Setup.exe'
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process created: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe 'C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe' --mgmtserver='dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com' --logfile='C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log' --parentpid='3536' --products='all' --customertoken='c137cbf0-9edc-44af-9f35-0c4b232335ec' --pipewritehandle='1812' --mcscustomerid='2e6fbc9a-e3b7-4473-a9ed-6dafc48bc5f5'
Source: C:\Users\user\Desktop\SophosSetup (9).exe Process created: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe 'C:\Users\user~1\AppData\Local\Temp\sfl-0719c400\Setup.exe' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process created: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe 'C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe' --mgmtserver='dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com' --logfile='C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log' --parentpid='3536' --products='all' --customertoken='c137cbf0-9edc-44af-9f35-0c4b232335ec' --pipewritehandle='1812' --mcscustomerid='2e6fbc9a-e3b7-4473-a9ed-6dafc48bc5f5' Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Continue
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Automated click: Install
Source: SophosSetup (9).exe Static PE information: certificate valid
Source: SophosSetup (9).exe Static file information: File size 1565616 > 1048576
Source: SophosSetup (9).exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x175c00
Source: SophosSetup (9).exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: SophosSetup (9).exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\workspace\_bin\Win32\Release\SafeLauncher.pdb source: SophosSetup (9).exe
Source: Binary string: su-setup32.pdb source: su-setup32.exe.1.dr
Source: Binary string: C:\workspace\_bin\Win32\Release\Build\SophosSetup_Stage2.pdb source: SophosSetup_Stage2.exe, 00000003.00000000.251883081.00000000002B6000.00000002.00020000.sdmp
Source: Binary string: C:\workspace\_bin\Win32\Release\Setup.pdb source: SophosSetup (9).exe

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_002462F0 __EH_prolog3_GS,CreateCompatibleDC,SelectObject,LoadLibraryW,GetProcAddress,SelectObject,DeleteDC, 3_2_002462F0
PE file contains an invalid checksum
Source: SophosSetup (9).exe Static PE information: real checksum: 0x63e1d4 should be: 0x1897be
PE file contains sections with non-standard names
Source: su-setup64.exe.1.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260468 push ecx; ret 3_2_0026047B
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0029C754 push ecx; ret 3_2_0029C769
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260C96 push ecx; ret 3_2_00260CA9

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SophosSetup_Stage2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SUL.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\SDDS3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Jump to dropped file
Source: C:\Users\user\Desktop\SophosSetup (9).exe File created: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe File created: C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log Jump to behavior

Boot Survival:

barindex
Creates or modifies windows services
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sophos Endpoint Defense\TamperProtection\Components\INSTALLER Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_001C8A6D __EH_prolog3,StartServiceW,GetLastError, 3_2_001C8A6D

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00240E70 IsIconic,ShowWindow, 3_2_00240E70
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SophosSetup (9).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup32.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Dropped PE file which has not been started: C:\Program Files (x86)\Sophos\CloudInstaller\extract_cache\su-setup64.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe TID: 4704 Thread sleep time: -90000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe TID: 5800 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0025DDDA FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError, 3_2_0025DDDA
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00227B7C __EH_prolog3_catch_GS,FindFirstFileW,FindNextFileW,GetLastError,std::bad_exception::bad_exception, 3_2_00227B7C
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: VMWARE_VSHIELD
Source: SophosSetup_Stage2.exe, 00000003.00000003.369443250.000000000840F000.00000004.00000001.sdmp Binary or memory string: 059d9d546a88cded193c090cb7759b9dx000.xml301a2508b74x000.xml7bx000.xmlg>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><Dictionary xmlns="badger:dictionary"><Lang>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373177699.00000000083C7000.00000004.00000001.sdmp Binary or memory string: -44B79FBBA885</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Platforms"><Platform>VMWARE_VSHIELD</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>\Sophos\Cl
Source: SophosSetup_Stage2.exe, 00000003.00000002.519416378.0000000007FB0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lVMWARE_VSHIELD
Source: 5924-519-197234022.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savi</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C141A9CB-1AE5-4F4D-9A13-44B79FBBA885</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Platforms"><Platform>VMWARE_VSHIELD</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savi</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C141A9CB-1AE5-4F4D-9A13-44B79FBBA885</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Platforms"><Platform>VMWARE_VSHIELD</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>\Sophos\Cl
Source: SophosSetup_Stage2.exe, 00000003.00000003.369443250.000000000840F000.00000004.00000001.sdmp Binary or memory string: g>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><Dictionary xmlns="badger:dictionary"><Lang>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>q
Source: SophosSetup_Stage2.exe, 00000003.00000003.373177699.00000000083C7000.00000004.00000001.sdmp Binary or memory string: -44B79FBBA885</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Platforms"><Platform>VMWARE_VSHIELD</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: Setup.exe, 00000001.00000003.238976471.0000000002EA6000.00000004.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: 6e5e7643dffb105ec409f75de45de108x000.xml2508b74x000.xml7bx000.xmlg>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><Dictionary xmlns="badger:dictionary"><Lang>en</Lang><Labels><Line><Label token="8cee0502-096d-4d98-887c-36e19b59464d"><Short>SVE Engine</Short><Long>Anti-Virus Engine for Sophos for Virtual Environments</Long></Label><Label token="CB36415C-CF37-4B7B-B5CD-88C3CA5B5680"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label><Label token="D9BB257D-ADE6-47C9-B09E-1ACB33A88EDD"><Short>LinuxEngine x64</Short><Long>Linux Anti-virus Engine for x86-64</Long></Label><Label token="FD6C1066-E190-4F44-AD0E-F107F36D9D40"><Short>Sophos for Virtual Environments</Short><Long>Sophos for Virtual Environments</Long></Label></Line><Name><Label token="6E5E37E2-593A-487B-A1A9-8EEEE4712D8D"><Short>1.3.5 VE3.79.0</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="84F7247F-2EC7-459A-9942-2FBB138F6302"><Short>3.79.0.187</Short><Long>libsavi v3.79.0.187</Long></Label><Label token="90577989-943A-4ABD-9A2B-F8CEC451C108"><Short>1.3.5.34</Short><Long>Sophos for Virtual Environments v1.3.5</Long></Label><Label token="C141A9CB-1AE5-4F4D-9A13-44B79FBBA885"><Short>SVE Engine 3.79.0.22</Short><Long>Anti-Virus Engine for SVE v3.79.0.22</Long></Label></Name><Lifestage><Label token="PROVISIONAL"><Short>Provisional</Short><Long>Provisional</Long></Label></Lifestage><ReleaseTags><Label token="2A7C0559-DC56-487A-A79B-8B06C6AB8236"><Short>Recommended - for computers that need the most up to date protection, see KBA 119216</Short><Long>Recommended for base version 10</Long></Label></ReleaseTags><Features><Label token="AV"><Short>Anti-virus</Short><Long>Anti-virus</Long></Label></Features><Platforms><Label token="LINUX.AMD64.GLIBC.2.3-GCC4.8.1"><Short>Linux AMD64</Short><Long>Linux.amd64.glibc.2.3-gcc4.8.1</Long></Label><Label token="VIRTUALIZATION"><Short>Virtualization Security</Short><Long>Virtualization Security</Long></Label><Label token="VMWARE_VSHIELD"><Short>VMware vShield</Short><Long>VMware vShield</Long></Label></Platforms><Roles><Label token="EPS"><Short>EPS</Short><Long>Endpoint Protection Suite</Long></Label><Label token="SAU"><Short>SAU</Short><Long>Sophos Auto-Update</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="VDATA"><Short>VDATA</Short><Long>Sophos Virus Data</Long></Label><Label token="VE"><Short>VE</Short><Long>Sophos Virus Engine</Long></Label></Roles><SAVLine><Label token="SAVEEXP"><Short>SAVXP</Short><Long>SAV For 2000+ Line</Long></Label><Label token="SVESOPHOSSVM"><Short>SVE</Short><Long>Sophos for Virtual Environments Security VM Line</Long></Label></SAVLine><TargetTypes><Label token="ENDPOINT"><Short>ENDPOINT</Short><Long>Endpoint deployment supported</Long></Label></TargetTypes></Labels></Dictionary>y
Source: SophosSetup_Stage2.exe, 00000003.00000002.519416378.0000000007FB0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW&Kf
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savi</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C141A9CB-1AE5-4F4D-9A13-44B79FBBA885</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Platforms"><Platform>VMWARE_VSHIELD</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>h+KnO9eLua4FrRnBG9x
Source: SophosSetup_Stage2.exe, 00000003.00000002.519416378.0000000007FB0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SophosSetup_Stage2.exe, 00000003.00000002.519416378.0000000007FB0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: VMware vShield
Source: C:\Users\user\Desktop\SophosSetup (9).exe API call chain: ExitProcess graph end node

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260867 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00260867
Contains functionality to dynamically determine API calls
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_002462F0 __EH_prolog3_GS,CreateCompatibleDC,SelectObject,LoadLibraryW,GetProcAddress,SelectObject,DeleteDC, 3_2_002462F0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\SophosSetup (9).exe Code function: 0_2_01362210 EntryPoint,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetProcessHeap,GetCommandLineW,HeapAlloc,HeapAlloc,HeapFree,HeapFree,HeapFree, 0_2_01362210
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_002609FA SetUnhandledExceptionFilter, 3_2_002609FA
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_0026066C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0026066C
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260867 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00260867

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process created: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe 'C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe' --mgmtserver='dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com' --logfile='C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log' --parentpid='3536' --products='all' --customertoken='c137cbf0-9edc-44af-9f35-0c4b232335ec' --pipewritehandle='1812' --mcscustomerid='2e6fbc9a-e3b7-4473-a9ed-6dafc48bc5f5' Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process created: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe 'C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe' --mgmtserver='dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com' --logfile='C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log' --parentpid='3536' --products='all' --customertoken='c137cbf0-9edc-44af-9f35-0c4b232335ec' --pipewritehandle='1812' --mcscustomerid='2e6fbc9a-e3b7-4473-a9ed-6dafc48bc5f5'
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Process created: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe 'C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe' --mgmtserver='dzr-mcs-amzn-us-west-2-fa88.upe.p.hmr.sophos.com' --logfile='C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller_20210513_141305.log' --parentpid='3536' --products='all' --customertoken='c137cbf0-9edc-44af-9f35-0c4b232335ec' --pipewritehandle='1812' --mcscustomerid='2e6fbc9a-e3b7-4473-a9ed-6dafc48bc5f5' Jump to behavior
Source: C:\Users\user\Desktop\SophosSetup (9).exe Code function: 0_2_01362210 EntryPoint,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetProcessHeap,GetCommandLineW,HeapAlloc,HeapAlloc,HeapFree,HeapFree,HeapFree, 0_2_01362210
Source: Setup.exe, 00000001.00000002.506365044.0000000003390000.00000002.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.505394784.0000000003D70000.00000002.00000001.sdmp Binary or memory string: uProgram Manager
Source: Setup.exe, 00000001.00000002.506365044.0000000003390000.00000002.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.505394784.0000000003D70000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: Setup.exe, 00000001.00000002.506365044.0000000003390000.00000002.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.505394784.0000000003D70000.00000002.00000001.sdmp Binary or memory string: Progman
Source: Setup.exe, 00000001.00000002.506365044.0000000003390000.00000002.00000001.sdmp, SophosSetup_Stage2.exe, 00000003.00000002.505394784.0000000003D70000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260A6E cpuid 3_2_00260A6E
Contains functionality to query locales information (e.g. system language)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: GetLocaleInfoW, 3_2_00274332
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00260CAB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 3_2_00260CAB
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00225560 __EH_prolog3_GS,GetUserNameExW,GetLastError,GetUserNameExW,GetLastError,std::bad_exception::bad_exception, 3_2_00225560
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe Code function: 3_2_00229DDF __EH_prolog3_GS,GetVersionExW,GetVersionExW,GetModuleHandleW,GetProcAddress, 3_2_00229DDF
Source: C:\Users\user\AppData\Local\Temp\sfl-0719c400\Setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: SophosSetup_Stage2.exe, 00000003.00000002.522424600.00000000089A1000.00000004.00000001.sdmp Binary or memory string: SavService.exe
Source: SophosSetup_Stage2.exe Binary or memory string: AlMon.exe
Source: SophosSetup_Stage2.exe Binary or memory string: SAVAdminService.exe
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: SophosSetup_Stage2.exe Binary or memory string: SAVService.exe
Source: SophosSetup_Stage2.exe, 00000003.00000003.275594694.0000000008193000.00000004.00000001.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: SophosSetup_Stage2.exe Binary or memory string: ALSvc.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Program Files (x86)\Sophos\CloudInstaller\SophosSetup_Stage2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : select * from AntiVirusProduct

Stealing of Sensitive Information:

barindex
OS version to string mapping found (often used in BOTs)
Source: 5924-576-1753778876.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><Dictionary xmlns="badger:dictionary"><Lang>en</Lang><Labels><Line><Label token="D4942C57-CC80-4BE7-B4AF-C6EF263B9EC9"><Short>DOTNET</Short><Long>.NET framework</Long></Label><Label token="F1DAD925-C973-4e5e-B172-78E97EB60689"><Short>DENC</Short><Long>Sophos Device Encryption</Long></Label><Label token="WindowsCloudEncryption"><Short>CloudEncryption</Short><Long>Windows Cloud Encryption</Long></Label></Line><Name><Label token="1F2CDBF5-A7B0-4C2A-8B29-8D7ED518DE2E"><Short>2.0.57</Short><Long>Windows Cloud Encryption 2.0.57</Long></Label><Label token="22B73913-8789-4365-A3A6-CDC1DF0FB3BD"><Short>1.20.63.0</Short><Long>Cloud Encryption for Windows v1.20.63.0</Long></Label><Label token="5DC47558-031E-49AE-ADCB-791D9F2F0BE2"><Short>1.0.0.21</Short><Long>.NET Framework for Windows v1.0.0.21</Long></Label><Label token="6280BDF7-6AD6-4D33-A3AF-AB6B306916A3"><Short>2.0.70</Short><Long>Windows Cloud Encryption 2.0.70</Long></Label><Label token="6F49F3CF-3EED-41F1-9FD3-AB897E414E70"><Short>1.20.57.0</Short><Long>Cloud Encryption for Windows v1.20.57.0</Long></Label><Label token="7A5A2934-D46F-467A-A9F9-FB5C6C8C8E5A"><Short>1.4.103.0</Short><Long>Cloud Encryption for Windows v1.4.103.0</Long></Label><Label token="83898130-FCFB-4C03-8678-9A4E91C8F30B"><Short>2.0.50</Short><Long>Windows Cloud Encryption 2.0.50</Long></Label><Label token="94DA83D8-14CB-4B5B-9959-8268254DB70B"><Short>1.20.70.0</Short><Long>Cloud Encryption for Windows v1.20.70.0</Long></Label><Label token="A04C7C21-AA7E-4D13-ACF4-D627F28E1824"><Short>1.4.43</Short><Long>Windows Cloud Encryption 1.4.43</Long></Label><Label token="A8339570-5552-48B8-8350-1266D295BDAC"><Short>1.4.43.0</Short><Long>Cloud Encryption for Windows v1.4.43.0</Long></Label><Label token="BFAD2841-0E83-44EF-88C9-C474B15B0049"><Short>2.0.38</Short><Long>Windows Cloud Encryption 2.0.38</Long></Label><Label token="C468B8AA-478F-484D-86FB-74519C53833B"><Short>4.5.2.19</Short><Long>.NET Framework for Windows v4.5.2.19</Long></Label><Label token="D13DB990-A873-4BC9-9404-1823314089CB"><Short>1.20.51.0</Short><Long>Cloud Encryption for Windows v1.20.51.0</Long></Label><Label token="DAEA7583-BC78-4460-9EA1-4E31DFF3B196"><Short>2.0.63</Short><Long>Windows Cloud Encryption 2.0.63</Long></Label><Label token="DBA703FD-4FB5-49E9-BDAD-A34F93D5B73F"><Short>1.3.90</Short><Long>Windows Cloud Encryption 1.3.90</Long></Label><Label token="E06DC7D9-F2B6-420E-B700-7EA0A8472B6B"><Short>1.20.81.0</Short><Long>Cloud Encryption for Windows v1.20.81.0</Long></Label><Label token="E3DFE7A6-2261-42E0-AFAD-84AC9D320020"><Short>1.4.103</Short><Long>Windows Cloud Encryption 1.4.103</Long></Label><Label token="E47D3C25-AC17-4E25-8445-7964F06D034E"><Short>1.20.38.0</Short><Long>Cloud Encryption for Windows v1.20.38.0</Long></Label><Label token="E9EAADD2-8A27-42D0-AD09-78CE620AC668"><Short>2.0.81</Short><Long>Windows Cloud Encryption 2.0.81</Long></Label><Label token="FC28080D-8517-46F0-8E5E-A675B06EEE3D"><Short>1.3.90.0
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3316C911-987B-41B4-B897-1FEAFE77E0F3</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>a
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64@
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: b638afa0acb199575a022f8d505f923cx000.xml3998420ffa1da5ff477bdx000.xmltributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>58101F9C-1E65-44D7-AA77-10AEC4AEF0C6</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_81
Source: SophosSetup_Stage2.exe, 00000003.00000003.374953800.00000000058CE000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4EC76D1F-268A-4798-AB63-C913D33779F8</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>9d0
Source: SophosSetup_Stage2.exe, 00000003.00000003.368343737.00000000059EA000.00000004.00000001.sdmp Binary or memory string: tform>WIN_7</Platform><Platform>WIN_7_X64</Platf
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X646
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTA_X64
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64L
Source: SophosSetup_Stage2.exe, 00000003.00000003.373699914.0000000005954000.00000004.00000001.sdmp Binary or memory string: IONAL</Lifestage></Attribute><Attribute name="Name"><Name>98AA922D-5AEB-4C36-AA76-192F213F006D</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>)|+U
Source: SophosSetup_Stage2.exe, 00000003.00000003.373196718.0000000008116000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>9DFFEF5A-B058-4C59-BEFD-A6788961E0A0</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: orm>WIN_XP</$
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3A5E6E63-B258-4FDB-B79F-FF0349E12939</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>91BA22B9-8CFB-45A3-AD6D-C388D9EB5A57</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ProductRelease>
Source: 5924-50-1856957386.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>589D875F-6678-461D-B0DC-56A5A1B5DBD6</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_708_R2_SVR_
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>19B21F1F-19FD-453E-B131-596034E83890</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/version><version><attributes><
Source: SophosSetup_Stage2.exe, 00000003.00000003.371479641.0000000008123000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0764AD54-4D53-4479-837F-4AC535AA96AC</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>so
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7e
Source: SophosSetup_Stage2.exe, 00000003.00000003.369964211.00000000058E6000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5D6BF2A5-86CC-4266-AB80-B38C7030E8D3</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes></
Source: 5924-78-445244717.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BA811F2B-DEE9-49C7-AE23-300BEBD2509F</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FA9B0F75-D6C4-45D1-85B5-E7DB0F9B2573</Name></Attribute><Attribute name="Features"><Feature>UC</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_81_SVR_X64</Platform></Attribute><Attribute name="Roles"><Role>UC</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>821F3BAF-22D0-4900-8BEB-995C3C5CE946</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.371479641.0000000008123000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C644626C-62A8-4342-9E36-B5329289E3AC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>TargetType></k
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>22B73913-8789-4365-A3A6-CDC1DF0FB3BD</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>DD52C63}\
Source: SophosSetup_Stage2.exe, 00000003.00000003.374953800.00000000058CE000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3F30EF47-E894-425A-8565-135F652B9F69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>AA
Source: SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E3C4EF97-5DC1-4BA5-A3A4-911F2760658D</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>01D13EC1-A8AB-4575-97E6-23CB42B9488E</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>DA1MDQxNTE2NTV
Source: 5924-369-888490065.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0070A9A2-8698-4D9A-926E-4774802D1E7F</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B6122C8C-7EC4-496B-AA10-E1917320F4C6</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>RECOMMENDED</Tag><Label>5F49DC4A-8302-4C8A-9C62-1F7E0A17F56C</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>P`
Source: SophosSetup_Stage2.exe, 00000003.00000003.373510445.00000000080ED000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>264DE98E-7F79-418D-9884-20EB7D507BC1</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>[
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.372187382.00000000082D1000.00000004.00000001.sdmp Binary or memory string: form>WIN_8_X64</Platform><Plat
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E323553-67CC-40BE-B932-36003A18FFC9</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ttributes>50128b719330d6424a5y9[
Source: SophosSetup_Stage2.exe, 00000003.00000003.371356334.00000000058F5000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3F245DD0-B588-4C4E-9F38-980CEFF659D9</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a.xml</WarehoB
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_8_SVR_X64
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A75824A6-9B17-437C-A63D-5D2F14FF4C5C</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.70.2.0</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>5969457cebd2e38dbd25
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7A5A2934-D46F-467A-A9F9-FB5C6C8C8E5A</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>W
Source: SophosSetup_Stage2.exe, 00000003.00000003.373865395.00000000083E9000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D7C32036-554F-4581-8B0A-A90318919E25</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_8ONAL@
Source: 5924-574-1807146546.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>94DA83D8-14CB-4B5B-9959-8268254DB70B</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C46C4A15-5A6A-4F55-8968-C102BE6CB269</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>="ntp64"><I
Source: SophosSetup_Stage2.exe, 00000003.00000003.373884092.00000000083FA000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E47D3C25-AC17-4E25-8445-7964F06D034E</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E2093F8-6D51-4325-A0B6-64E525737BA5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7B0F050D-C18A-4F49-A5D5-4AF8D5185B7F</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.10</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpe
Source: SophosSetup_Stage2.exe, 00000003.00000003.373764674.00000000058DB000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>CBFC0043-2DCA-4338-89F5-A29E2969F84A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64l
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64p
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>23D29FFD-C603-4E08-B219-897D2D80FA41</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>fF}
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64p
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>8CC0185B-4567-427D-B08F-64801B947CB2</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.80.1.0</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64l
Source: SophosSetup_Stage2.exe, 00000003.00000003.373123564.00000000059B2000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A0C413BD-6E5E-4828-8554-056ABEAA9E37</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-5</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369408409.000000000833E000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FFB8E64D-5790-4D17-9230-2A32CCEEF531</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a3eabe622404@
Source: 5924-176-670326161.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>16D8083D-87EF-473D-9D17-92714A8330A3</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><package xmlns="badger:package" name="LIVETERMINAL64 1.2.4.0" version="1.2.4.0"><contents><md5 extent="x000" sha384="b62d4c33b9ae45ecc30d3545caebe8d26be3d2075ccb27f124b4228d6acf56d6b200e80eb119ade9a184dceb637373c8" size="1910">bbf0fd7a669bfdb2f9038e2f159e649e</md5></contents><subpackages /></package>ows 8 (64 bit)</Long></Label><Label token="WIN_81"><Short>Win81</Short><Long>Windows 8.1</Long></Label><Label token4
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B765C915-E3A0-4434-A5B0-F8A083FFA41F</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>BETA2</Tag><Label>A3D9ED24-2E48-4F39-8B23-2D1D0E1FD750</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-1-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64@
Source: SophosSetup_Stage2.exe, 00000003.00000003.373386063.000000000834A000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>94F72849-230F-4B7D-B34E-B78AEF0CB717</Name></Attribute><Attribute name="Features"><Feature>MTR_E</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373113613.0000000005A0C000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4973BCDE-9297-4FAD-87F6-F9A1923C8772</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>ory><Warehouse>
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F5874933-E9BE-44B1-827F-55EE47DD4271</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>434DBFC2-D59F-4511-80AB-91FEE7C5CE69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>m
Source: SophosSetup_Stage2.exe, 00000003.00000003.368940864.000000000585E000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>89A149FA-F894-4249-B62A-AF4A51071198</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>orm>WIN_81</PlG
Source: SophosSetup_Stage2.exe, 00000003.00000003.373386063.000000000834A000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FA8999AF-89C3-4ABC-99F9-4B2C036B7EE2</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_73
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>79F415B7-3AC5-42B6-8439-DEE78C5127E0</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>>LATEST</Ta
Source: SophosSetup_Stage2.exe, 00000003.00000003.374906368.00000000059B0000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>91AE1B31-D1ED-4ABF-9387-5B1517B14576</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>RECOMMENDED</Tag><Label>5B99655E-5344-42CF-BB5C-031B26F71A66</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2021-1</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>"sse64
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><package xmlns="badger:package" name="ESHSUPP 3.0.217.0.1" version="3.0.217.0.1"><contents><md5 extent="x000" sha384="8cce51ef95d8553d0e0b350cfb58bb9bd22668945e1876fe9c18fcd311a852e9da5e95ec6ac44e89b73261c52e9c3e83" size="3895">52ce2fcc6a9ecd46319ca143cd2adbc8</md5></contents><subpackages /></package>res"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.esh_
Source: SophosSetup_Stage2.exe, 00000003.00000003.369762292.00000000058CD000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>21EE8DC9-2E6D-4164-9F30-EA04E90E78EC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>d5></attribut2
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64L
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F7A00F14-1FCE-4A74-81B3-CE0590CF0F2D</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>MYiuk6CQQnRxq
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64c Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.373123564.00000000059B2000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A0C413BD-6E5E-4828-8554-056ABEAA9E37</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-5</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>b93d51160a278b<
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64@
Source: SophosSetup_Stage2.exe, 00000003.00000003.371330529.00000000058AE000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C02FD7C9-3548-4BAE-8AE7-829A11328A72</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>71D7B766-A8F4-4D4E-BBF4-2F07F177D037</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>majorRollq
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_708_SVR
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0764AD54-4D53-4479-837F-4AC535AA96AC</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>1
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: bel><Label token="WIN_8_X64"><Short>Win8[
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E6299F42-73DA-464E-8C54-A5DB401CF2A8</Name></Attribute><Attribute name="Features"><Feature>MTR_E</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>74754872dab568dfc8b101724842beefd1695713a309f6174f625e4c22cd29d61cb81bcc65c42c1a
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>434DBFC2-D59F-4511-80AB-91FEE7C5CE69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>C
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6476AFEC-D798-4BE4-8EB5-83F61B6FF7C7</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>cf0X
Source: SophosSetup_Stage2.exe, 00000003.00000003.373442127.0000000005966000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0002AB08-394C-4ED9-9F53-9F7671C6EB67</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5099304-95EB-423E-A3A2-9C151E8239F3</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_7
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1F2CDBF5-A7B0-4C2A-8B29-8D7ED518DE2E</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_8
Source: SophosSetup_Stage2.exe, 00000003.00000003.368483546.0000000008339000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FFB8E64D-5790-4D17-9230-2A32CCEEF531</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-615-2075270219.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D7C32036-554F-4581-8B0A-A90318919E25</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AF71DDDF-3308-49FE-814A-E92D1F715677</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368471836.00000000058D9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>CBFC0043-2DCA-4338-89F5-A29E2969F84A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>Warehouse>sddA
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0B8D66AB-4024-4A43-B54A-1E0514D5A25C</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA</Tag><Label>34F7D2F5-1218-4FA8-A195-7E10141688CF</Label></ReleaseTag></Attribute></ReleaseAttributes>b2" size="331<
Source: SophosSetup_Stage2.exe, 00000003.00000003.369762292.00000000058CD000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3F30EF47-E894-425A-8565-135F652B9F69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>[
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_711_SVR_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.369526144.00000000059C9000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7B0F050D-C18A-4F49-A5D5-4AF8D5185B7F</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.10</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></Prod
Source: 5924-108-1608199376.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>21EE8DC9-2E6D-4164-9F30-EA04E90E78EC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F9D1633E-9F1F-4139-A92E-B2F5FB50DAF4</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>pvM1f6bmfMkjKTl
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C02FD7C9-3548-4BAE-8AE7-829A11328A72</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>E
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_81_SVR_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>22743DC7-F29C-4CA3-B06D-16905A872939</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368940864.000000000585E000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>589D875F-6678-461D-B0DC-56A5A1B5DBD6</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ole></Attrib
Source: SophosSetup_Stage2.exe, 00000003.00000003.374918567.00000000059B6000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><package xmlns="badger:package" name="Windows Cloud AV 11.6.360" version="11.6.360"><contents><md5 extent="x000" sha384="63b6a709ca85bab92418f09048bf6cca3b4f9e3934144623fe67f53b882adba08bd1ea2210146dfbd67060241fc73150" size="947">9dc59e3e8ec8d3873e4a8582654a0358</md5></contents><subpackages><subpackage path="efw"><md5 extent="x000" sha384="a7cff0c56c811ca2c700d6bbeac6fc7eb3a7499a646c0686518c2acac50d0e7c388d466429219ba3dc62408f56c1a5c6" size="329">a776ef8811f17637be51d931f51f558f</md5></subpackage><subpackage path="efw64"><md5 extent="x000" sha384="0d5761d30e1a9034dad9659ba06390a8a76b30ea093bf35b310ae393cc9146686033ae109e0e67e30fa3156c32dad293" size="331">104a16e64afdda9b1610c84521d771c6</md5></subpackage><subpackage path="savxp"><md5 extent="x000" sha384="4252b03093cebfbc47ba7e89f0ff05ba58b797202c6fb94c8264f53e4ac754c138aa190c69133b42ba98ebc9b3135b77" size="333">a92937796366877daffadee81f71ff4c</md5></subpackage><subpackage path="savxp"><md5 extent="x000" sha384="23c38c605334f516b2cae761195aa27c5c6fc0b73cb862bd41d9b05e7c4ed0b62a48186487ef7a2f44990ceff51ae4aa" size="338">b815bcf0da4f12550210fc4d59954ef5</md5></subpackage></subpackages></package>orm>WIN_81_SVRW
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4973BCDE-9297-4FAD-87F6-F9A1923C8772</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>464386f1_C
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3F30EF47-E894-425A-8565-135F652B9F69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>=
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: WIN_8_X64X644
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>84498E1D-3C5E-4365-8766-68A4B6A92D65</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>1f43b641
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6D47A33D-6624-44AC-8EB6-6E2B30C9E88C</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.6</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec
Source: SophosSetup_Stage2.exe, 00000003.00000003.368322856.00000000058C3000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3F30EF47-E894-425A-8565-135F652B9F69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>7
Source: SophosSetup_Stage2.exe, 00000003.00000003.372675681.00000000058AE000.00000004.00000001.sdmp Binary or memory string: orm>WIN_81</Pl
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: tform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rm>WIN_81_X64</I
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BC21624B-C970-42CB-97EE-4F70D97FC828</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA2</Tag><Label>E0A1004C-17C6-4D05-835B-3F2BA9642A16</Label></ReleaseTag></Attribute></ReleaseAttributes>ributes>,
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4344C3CE-3C2E-4B7A-B141-61473AE15A0A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: rm>WIN_81_X64</S
Source: SophosSetup_Stage2.exe, 00000003.00000003.368343737.00000000059EA000.00000004.00000001.sdmp Binary or memory string: orm><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Rolespx3
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64p
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: EFF659D9</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a.xml</WarehoX
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3E20098D-F8B2-4BD5-A533-AFB45E0B4E81</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.esh_rules.xml</Warehouse><ProductRelease><ProductLine>ESH_rules</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: 5924-146-55934264.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>53129580-32BD-44EE-BC96-A8537C6ECACA</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0A70AF40-5D95-410F-BC73-24511D126259</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>r9?
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>dotnet</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5DC47558-031E-49AE-ADCB-791D9F2F0BE2</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ributes>f9a3a9f04f807f288dP
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7A5A2934-D46F-467A-A9F9-FB5C6C8C8E5A</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>A78D17E}
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1311B2B8-A05C-4CF6-AAB5-B9B75A69CB74</Name></Attribute><Attribute name="Features"><Feature>HOMECORE</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>" majorRoll#
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>82CAD5F7-77D4-4409-A717-4E0E7A406794</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_latest</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_next</DecodePath></Supplement></Attribute></ReleaseAttributes>/
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: rm>WIN_81_X64</+
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>58101F9C-1E65-44D7-AA77-10AEC4AEF0C6</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: rm>WIN_81_X64</1
Source: SophosSetup_Stage2.exe, 00000003.00000003.373196718.0000000008116000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B35DE857-CC95-473D-B084-702FE0A697E4</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>RzaGlyZTELMAkGA1UEBhMCVUsxEzARBgNVBAoT&#x0A;ClNvcGhvcyBMdGQxGjAYBgNVBAsTEVNvcGhvc1NlY3VyZUJ1aWxkMIG/MA0GCSqG&#x0A;SIb3DQEBAQUAA4GtADCBqQKBoQDWmuHa4A6nSal4VSWqR8RSJ/Qu+x4rAnyrU6Fa&#x0A;yg8Vj
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64l
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: WIN_7_X64-
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTAl
Source: SophosSetup_Stage2.exe, 00000003.00000003.374233025.000000000833B000.00000004.00000001.sdmp Binary or memory string: </Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>FD
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: WIN_7_X644
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: m>WIN_81_X64(/
Source: 5924-72-1192326080.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4EC76D1F-268A-4798-AB63-C913D33779F8</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64@
Source: SophosSetup_Stage2.exe, 00000003.00000003.373865395.00000000083E9000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FC28080D-8517-46F0-8E5E-A675B06EEE3D</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-603-1662866752.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>24B3C54F-9E6C-498E-B427-3C007864570E</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>dotnet</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5DC47558-031E-49AE-ADCB-791D9F2F0BE2</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ha384="1f9f{
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2EA3933D-2237-4AB6-A270-39C5034BA926</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>-
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_XPTA_X64ro
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64L
Source: SophosSetup_Stage2.exe, 00000003.00000003.368483546.0000000008339000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B35DE857-CC95-473D-B084-702FE0A697E4</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a3eaMMX
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DB9BC4B0-116C-4016-82C8-DA44EDE9D525</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>=i
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D13DB990-A873-4BC9-9404-1823314089CB</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>5DCF675}u
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>98FF74D4-439D-48CB-87AA-8D4E97FDB10E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/m
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMDR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1A7C09DF-7C99-424D-9AC6-C457806A6EF6</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>p))X
Source: SophosSetup_Stage2.exe, 00000003.00000002.520475839.0000000008533000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><DictionariesCatalog xmlns="badger:dictionariescatalog"><DefaultDictionary>en</DefaultDictionary><Dictionaries><Dictionary lang="en"><md5 extent="x000" sha384="d0e4fcd0055b0cd619bf2d299f918da701754ee8ede9ee9c9d4fa1e16a7efe481a292ca2e25dbb34de917d0c028e97ca" size="1762">c30b6ec1de38cf32c046358d7a6bf9ed</md5></Dictionary></Dictionaries></DictionariesCatalog>e="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.esh_rules.xml</Warehouse><ProductRelease
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTA_X64\
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>dotnet</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5DC47558-031E-49AE-ADCB-791D9F2F0BE2</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ha384="1f9fa
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F3F32BD2-3B7B-4830-9B2C-31FF1D738382</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>E629CAD9-B6A4-47B8-8B2F-16B8FD42067B</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>S
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_7_X64\
Source: SophosSetup_Stage2.exe, 00000003.00000003.375374029.0000000005971000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>57D9AF84-6B6F-4805-8DB8-398BF1D829EA</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_81ONAL Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAE72DAC-560C-418E-A0EF-7BED3D39285B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>nZAA/Mlh7VvsGmvUt9048BCgryBWtrMXgH
Source: 5924-623-2004761582.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAE72DAC-560C-418E-A0EF-7BED3D39285B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AF2A12D6-4F30-4A52-A6D4-5A0F2059B92D</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>nIw
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2C0B968-EE36-4539-8E04-7F1844A62251</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA</Tag><Label>34F7D2F5-1218-4FA8-A195-7E10141688CF</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2021-1-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ckage pat
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5099304-95EB-423E-A3A2-9C151E8239F3</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ProductRg
Source: 5924-142-1965484310.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>98FF74D4-439D-48CB-87AA-8D4E97FDB10E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D1C792B5-98A2-4A6B-919E-0BDCD1331CEC</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>:
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2979C211-A25E-41B4-AC39-344D52316484</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369430789.00000000083AA000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E504247D-30CB-4EDB-BA52-DC2DFC930B3C</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>RECOMMENDED</Tag><Label>5F49DC4A-8302-4C8A-9C62-1F7E0A17F56C</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-1</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DCA3AA9D-7B9C-460F-8C24-619ABE4143D4</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>m>WIN_21
Source: SophosSetup_Stage2.exe, 00000003.00000003.372151242.00000000082D7000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6D8DD4A5-4BCC-44C6-A58A-E7C33B198D67</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C46C4A15-5A6A-4F55-8968-C102BE6CB269</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>="ntp64"><
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>91BA22B9-8CFB-45A3-AD6D-C388D9EB5A57</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>cdf9b9c3e7bb6015
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64c Pro
Source: 5924-573-630375960.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>22B73913-8789-4365-A3A6-CDC1DF0FB3BD</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-613-1690392914.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7C6E95D4-8F19-4FE1-B6AD-D4B2EFEF48FA</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E21A8C99-43A1-47A3-8E3D-9FF0029225CB</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2019-3</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: WIN_708_R2_SVR_
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTA
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTA_X644
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>98FF74D4-439D-48CB-87AA-8D4E97FDB10E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>2C
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: WIN_81_X64">$
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A04C7C21-AA7E-4D13-ACF4-D627F28E1824</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>oUpdateP~,
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3A5E6E63-B258-4FDB-B79F-FF0349E12939</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>>>E
Source: SophosSetup_Stage2.exe, 00000003.00000003.369507664.0000000008122000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FA9B0F75-D6C4-45D1-85B5-E7DB0F9B2573</Name></Attribute><Attribute name="Features"><Feature>UC</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_81_SVR_X64</Platform></Attribute><Attribute name="Roles"><Role>UC</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ibutes>8
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><DictionariesCatalog xmlns="badger:dictionariescatalog"><DefaultDictionary>en</DefaultDictionary><Dictionaries><Dictionary lang="en"><md5 extent="x000" sha384="b2b867b9e5280b3127d14e8fa44edfd5b6e2216b80594ef3c6bf96788acc911bd8f6205372302d2b714288c6893c7a89" size="4698">4b346e5d85bfd8f8c3f0d1be9d86184d</md5></Dictionary></Dictionaries></DictionariesCatalog>="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>wMykV97AgF/X3EONk7GZ9eAIsc0e9TrcboXhe
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64ic Pro
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>66B106A1-4892-4607-B1BB-6A7458C45494</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>\2e5d20ee4657eb03ad
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: /Long></Label><Label token="WIN_81_X64">5
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>923F13CB-94B4-4C23-AEB3-3F261382803F</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>bute><Attribute name="Lifestage"><Lifes
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5B3B3BD-E198-48DF-82FA-55F898C68011</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>fb82422"S
Source: SophosSetup_Stage2.exe, 00000003.00000003.374953800.00000000058CE000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>21EE8DC9-2E6D-4164-9F30-EA04E90E78EC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>d5></attribut
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1CAAD87F-A9B9-4A33-AA61-A828549F8C7F</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5FC8059-D40F-455D-AFC0-73C6999FC679</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.74.1.3</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>}
Source: SophosSetup_Stage2.exe, 00000003.00000003.369526144.00000000059C9000.00000004.00000001.sdmp Binary or memory string: ibute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.SAVCNTRL.xml</Warehouse><ProductRelease><ProductLine>SAVCONTROLLINE</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>CEP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAtt
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>821F3BAF-22D0-4900-8BEB-995C3C5CE946</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.374579501.0000000008341000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E323553-67CC-40BE-B932-36003A18FFC9</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ZZ
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>21ED092F-B8E0-44F5-B70A-42BCC503BEFE</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>91C8543A-CC1C-41C0-8882-BDB0C340B937</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>8123d70ecf1a2b3
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E47D3C25-AC17-4E25-8445-7964F06D034E</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>8f}
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_81 W
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: m>WIN_81_X64(
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>593D0AAB-EB57-4C56-89FD-50F8184BA570</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7raphic Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.374161160.0000000005896000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>923F13CB-94B4-4C23-AEB3-3F261382803F</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>264DE98E-7F79-418D-9884-20EB7D507BC1</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>dotnet</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5DC47558-031E-49AE-ADCB-791D9F2F0BE2</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5A4CF53B-63D1-4978-ABAB-8FB1FCAAB9A1</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>/version></versions></rigidName>U7E/99v
Source: SophosSetup_Stage2.exe, 00000003.00000003.372366819.00000000082F9000.00000004.00000001.sdmp Binary or memory string: nfrastructure Components</Long></Label><Label token="DISKENCRYPTION"><Short>Full Disk Encryption</Short><Long>Full Disk Encryption</Long></Label><Label token="DLP"><Short>Data Control</Short><Long>Data Control</Long></Label><Label token="DVCCNTRL"><Short>Device Control</Short><Long>Device Control</Long></Label><Label token="EFW"><Short>EFW</Short><Long>EFW</Long></Label><Label token="HIPS"><Short>HIPS</Short><Long>Host Intrusion Prevention</Long></Label><Label token="LIVEQUERY"><Short>LIVEQUERY</Short><Long>LIVEQUERY</Long></Label><Label token="MDR"><Short>MTR</Short><Long>MTR</Long></Label><Label token="NTP"><Short>Malicious Traffic Detection</Short><Long>Malicious Traffic Detection</Long></Label><Label token="PUA"><Short>Application Control</Short><Long>Application Control</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="UC"><Short>UC</Short><Long>UC</Long></Label><Label token="WEBCNTRL"><Short>Web Control</Short><Long>Web Control</Long></Label><Label token="XPD"><Short>Exploit Prevention</Short><Long>Exploit Prevention</Long></Label></Features><Platforms><Label token="WIN_10"><Short>Win 10</Short><Long>Windows 10</Long></Label><Label token="WIN_10_SVR_X64"><Short>Win10SVRX64</Short><Long>Windows 10 server</Long></Label><Label token="WIN_10_X64"><Short> Win10X64</Short><Long>Windows 10 (64 bit)</Long></Label><Label token="WIN_2003_SVR"><Short>Win2003</Short><Long>Windows 2003</Long></Label><Label token="WIN_2003_SVR_X64"><Short>Win2003X64</Short><Long>Windows 2003 (64-Bit)</Long></Label><Label token="WIN_2008_R2_SVR_X64"><Short>Win2008R2</Short><Long>Windows 2008 R2</Long></Label><Label token="WIN_2008_SVR"><Short>Win2008</Short><Long>Windows 2008</Long></Label><Label token="WIN_2008_SVR_X64"><Short>Win2008X64</Short><Long>Windows 2008 (64-Bit)</Long></Label><Label token="WIN_2011_SVR_X64"><Short>Win2011</Short><Long>Windows SBS 2011</Long></Label><Label token="WIN_2012_SVR_X64"><Short>Win2012</Short><Long>Windows 2012</Long></Label><Label token="WIN_7"><Short>Win7</Short><Long>Windows 7</Long></Label><Label token="WIN_7_X64"><Short>Win7X64</Short><Long>Windows 7 (64-bit)</Long></Label><Label token="WIN_8"><Short>Win8</Short><Long>Windows 8</Long></Label><Label token="WIN_8_SVR_X64"><Short>Win2012</Short><Long>Windows 2012</Long></Label><Label token="WIN_8_X64"><Short>Win8X64</Short><Long>Windows 8 (64 bit)</Long></Label><Label token="WIN_81"><Short>Win81</Short><Long>Windows 8.1</Long></Label><Label token="WIN_81_SVR_X64"><Short>Win2012R2</Short><Long>Windows 2012 R2</Long></Label><Label token="WIN_81_X64"><Short>Win81X64</Short><Long>Windows 8.1 (64-bit)</Long></Label><Label token="WIN_VISTA"><Short>Vista</Short><Long>Windows Vista</Long></Label><Label token="WIN_VISTA_X64"><Short>Vista64</Short><Long>Windows Vista (64-bit)</Long></Label><Label token="WIN_XP"><Short>WinXP</Short><Long>Windows XP</Long></Label><Label token="WIN_XP_X64"><Short>WinXP64</Short><Long>Windows XP (64-bit)</Long><
Source: SophosSetup_Stage2.exe, 00000003.00000003.369043332.000000000811F000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AB13FA1F-8526-4EAC-87B4-4C1BA0714191</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ribute name="}
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1213E010-0FC0-46C3-8C55-CA3B265CAE96</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.69.2.0</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373442127.0000000005966000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5951C491-621C-4CF8-95C3-E276CAEC3476</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.372698916.0000000005889000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>266E7FC7-BBB4-4BDF-ADDC-AF812FFBED03</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C644626C-62A8-4342-9E36-B5329289E3AC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ehouse><ProduE
Source: SophosSetup_Stage2.exe, 00000003.00000003.373280681.00000000082D2000.00000004.00000001.sdmp Binary or memory string: IN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>4)
Source: SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AB13FA1F-8526-4EAC-87B4-4C1BA0714191</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ribute name="
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>589D875F-6678-461D-B0DC-56A5A1B5DBD6</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>age=2Cache-
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>723C5196-BCCD-44C3-A8C9-5E7149C77CF8</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.epips_data.xml</Warehouse><ProductRelease><ProductLine>EPIPS_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>eleasX
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A93CFD68-6FC3-4DE5-BF20-8258D275BF3D</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>xml<B
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F16BFA31-3FAF-41B8-B326-0E80B924B6D4</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.77.1.28</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>es>qPm
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BFAD2841-0E83-44EF-88C9-C474B15B0049</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>9eLua4Fr
Source: SophosSetup_Stage2.exe, 00000003.00000003.368483546.0000000008339000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FFB8E64D-5790-4D17-9230-2A32CCEEF531</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a3eabe622404N
Source: 5924-242-1326499371.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BAA3C22D-E857-4AD0-BCD8-A0029FA1BF1B</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_XP_X6464ro
Source: 5924-262-129677254.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0002AB08-394C-4ED9-9F53-9F7671C6EB67</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: 5924-244-1359372745.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F18C9161-375C-4B67-98B5-9B99E13EA313</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FC28080D-8517-46F0-8E5E-A675B06EEE3D</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>7.3.8
Source: SophosSetup_Stage2.exe, 00000003.00000003.368322856.00000000058C3000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4344C3CE-3C2E-4B7A-B141-61473AE15A0A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>9961EAB5-4F62-4A93-A0C8-49024F89444F</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: s 8.1</Long></Label><Label token="WIN_81I
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E06DC7D9-F2B6-420E-B700-7EA0A8472B6B</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64l@
Source: SophosSetup_Stage2.exe, 00000003.00000003.374608834.000000000834C000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FFB8E64D-5790-4D17-9230-2A32CCEEF531</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a3eabe622404Z
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E3C4EF97-5DC1-4BA5-A3A4-911F2760658D</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>butes>fw%
Source: SophosSetup_Stage2.exe, 00000003.00000003.369933202.00000000059EE000.00000004.00000001.sdmp Binary or memory string: ><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1A5643D1-C8B7-4F2F-91DA-AAD60C3CBCC5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>rm>WIN_81_X64</1
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E9EAADD2-8A27-42D0-AD09-78CE620AC668</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>RECOMMENDED</Tag><Label>5F49DC4A-8302-4C8A-9C62-1F7E0A17F56C</Label></ReleaseTag></Attribute></ReleaseAttributes>EAxMmU29
Source: 5924-366-630559459.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F9D1633E-9F1F-4139-A92E-B2F5FB50DAF4</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A93CFD68-6FC3-4DE5-BF20-8258D275BF3D</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>xml<U
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>68C8235F-6264-434B-8FD2-F5764B25D641</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373123564.00000000059B2000.00000004.00000001.sdmp Binary or memory string: te><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2C0B968-EE36-4539-8E04-7F1844A62251</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA</Tag><Label>34F7D2F5-1218-4FA8-A195-7E10141688CF</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2021-1-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ckage pat%
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>89592D9C-90B5-4DD7-AC97-28EC943D310F</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.epips_data.xml</Warehouse><ProductRelease><ProductLine>EPIPS_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>rsionQ
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>73518AC3-CB70-4AF3-B1C4-EEC3762B328C</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: 5924-572-904041329.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6F49F3CF-3EED-41F1-9FD3-AB897E414E70</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DBA703FD-4FB5-49E9-BDAD-A34F93D5B73F</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6280BDF7-6AD6-4D33-A3AF-AB6B306916A3</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>^
Source: SophosSetup_Stage2.exe, 00000003.00000003.373688020.000000000813D000.00000004.00000001.sdmp Binary or memory string: ribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2A078592-8DCC-4420-A3E6-ACCBD1FC047F</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>m
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>53129580-32BD-44EE-BC96-A8537C6ECACA</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>2w
Source: 5924-270-370038065.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D69DA0A2-3FAF-469F-ACB0-FF6E14713593</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E8491874-6018-478C-8F8E-E6F1FD8CAC93</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.repairkit_supp.xml</Warehouse><ProductRelease><ProductLine>REPAIRKIT</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64p
Source: SophosSetup_Stage2.exe, 00000003.00000003.372151242.00000000082D7000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>8DB97248-6A67-41E8-B4C0-CDCFEBE8E84A</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>61849962-D8CA-4386-88B6-4E5E7ABAC485</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes></Release
Source: SophosSetup_Stage2.exe, 00000003.00000003.368343737.00000000059EA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>33911418-6E92-4ADB-8536-46F59284DC6C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>5f42a1ded37
Source: SophosSetup_Stage2.exe, 00000003.00000003.375341078.0000000005918000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2A078592-8DCC-4420-A3E6-ACCBD1FC047F</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>w
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E0ABE04-A0B9-436A-80DE-629B7B05E667</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>@
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2A562BD1-CE77-444F-8A38-DB225EBC0541</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>c51a3fd3afff0821e2600b76
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64IONo
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: ="WIN_8
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTAVR
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6280BDF7-6AD6-4D33-A3AF-AB6B306916A3</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>=
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E2093F8-6D51-4325-A0B6-64E525737BA5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>-
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8164ic Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.369933202.00000000059EE000.00000004.00000001.sdmp Binary or memory string: ><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>5f42a1ded37
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>8DB97248-6A67-41E8-B4C0-CDCFEBE8E84A</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes></md
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DF32239D-65A5-4D60-9101-F19E7D4FB9AB</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>Attributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373133189.00000000059B6000.00000004.00000001.sdmp Binary or memory string: orm>WIN_81_SVRM
Source: SophosSetup_Stage2.exe, 00000003.00000003.368471836.00000000058D9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A62D2479-2A97-4E6F-A902-3142CD27C651</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>90c
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64l
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B9DC90AC-3086-4950-A63F-F28B37FB8B3D</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.68.0.194</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>s>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E65B111-569E-4AAF-AF09-AB27C78315BD</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>E629CAD9-B6A4-47B8-8B2F-16B8FD42067B</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>-BC69-0129D965F311s1
Source: SophosSetup_Stage2.exe, 00000003.00000003.368367182.00000000082F8000.00000004.00000001.sdmp Binary or memory string: nfrastructure Components</Long></Label><Label token="DISKENCRYPTION"><Short>Full Disk Encryption</Short><Long>Full Disk Encryption</Long></Label><Label token="DLP"><Short>Data Control</Short><Long>Data Control</Long></Label><Label token="DVCCNTRL"><Short>Device Control</Short><Long>Device Control</Long></Label><Label token="EFW"><Short>EFW</Short><Long>EFW</Long></Label><Label token="HIPS"><Short>HIPS</Short><Long>Host Intrusion Prevention</Long></Label><Label token="LIVEQUERY"><Short>LIVEQUERY</Short><Long>LIVEQUERY</Long></Label><Label token="MDR"><Short>MTR</Short><Long>MTR</Long></Label><Label token="NTP"><Short>Malicious Traffic Detection</Short><Long>Malicious Traffic Detection</Long></Label><Label token="PUA"><Short>Application Control</Short><Long>Application Control</Long></Label><Label token="SAV"><Short>SAV</Short><Long>Sophos Anti-Virus</Long></Label><Label token="UC"><Short>UC</Short><Long>UC</Long></Label><Label token="WEBCNTRL"><Short>Web Control</Short><Long>Web Control</Long></Label><Label token="XPD"><Short>Exploit Prevention</Short><Long>Exploit Prevention</Long></Label></Features><Platforms><Label token="WIN_10"><Short>Win 10</Short><Long>Windows 10</Long></Label><Label token="WIN_10_SVR_X64"><Short>Win10SVRX64</Short><Long>Windows 10 server</Long></Label><Label token="WIN_10_X64"><Short> Win10X64</Short><Long>Windows 10 (64 bit)</Long></Label><Label token="WIN_2003_SVR"><Short>Win2003</Short><Long>Windows 2003</Long></Label><Label token="WIN_2003_SVR_X64"><Short>Win2003X64</Short><Long>Windows 2003 (64-Bit)</Long></Label><Label token="WIN_2008_R2_SVR_X64"><Short>Win2008R2</Short><Long>Windows 2008 R2</Long></Label><Label token="WIN_2008_SVR"><Short>Win2008</Short><Long>Windows 2008</Long></Label><Label token="WIN_2008_SVR_X64"><Short>Win2008X64</Short><Long>Windows 2008 (64-Bit)</Long></Label><Label token="WIN_2011_SVR_X64"><Short>Win2011</Short><Long>Windows SBS 2011</Long></Label><Label token="WIN_2012_SVR_X64"><Short>Win2012</Short><Long>Windows 2012</Long></Label><Label token="WIN_7"><Short>Win7</Short><Long>Windows 7</Long></Label><Label token="WIN_7_X64"><Short>Win7X64</Short><Long>Windows 7 (64-bit)</Long></Label><Label token="WIN_8"><Short>Win8</Short><Long>Windows 8</Long></Label><Label token="WIN_8_SVR_X64"><Short>Win2012</Short><Long>Windows 2012</Long></Label><Label token="WIN_8_X64"><Short>Win8X64</Short><Long>Windows 8 (64 bit)</Long></Label><Label token="WIN_81"><Short>Win81</Short><Long>Windows 8.1</Long></Label><Label token="WIN_81_SVR_X64"><Short>Win2012R2</Short><Long>Windows 2012 R2</Long></Label><Label token="WIN_81_X64"><Short>Win81X64</Short><Long>Windows 8.1 (64-bit)</Long></Label><Label token="WIN_VISTA"><Short>Vista</Short><Long>Windows Vista</Long></Label><Label token="WIN_VISTA_X64"><Short>Vista64</Short><Long>Windows Vista (64-bit)</Long></Label><Label token="WIN_XP"><Short>WinXP</Short><Long>Windows XP</Long></Label><Label token="WIN_XP_X64"><Short>WinXP64</Short><Long>Windows XP (64-bit)</Long><
Source: SophosSetup_Stage2.exe, 00000003.00000003.374918567.00000000059B6000.00000004.00000001.sdmp Binary or memory string: orm>WIN_81_SVRW
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>729E7904-D96A-4E19-A93B-C74E8873B317</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>:
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>7A5A2934-D46F-467A-A9F9-FB5C6C8C8E5A</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>W
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: orm>WIN_81_SVR
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F5874933-E9BE-44B1-827F-55EE47DD4271</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>64</Platform></
Source: 5924-443-1889516590.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2BAE49A4-48A4-4041-9ED4-5F95D4F65C19</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2019-2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.372212122.00000000059B5000.00000004.00000001.sdmp Binary or memory string: e></Attribute><Attribute name="Name"><Name>C46C4A15-5A6A-4F55-8968-C102BE6CB269</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>="ntp64"><I
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: n="WIN_81_X64">
Source: SophosSetup_Stage2.exe, 00000003.00000003.369043332.000000000811F000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E3C4EF97-5DC1-4BA5-A3A4-911F2760658D</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>d></VersiM
Source: SophosSetup_Stage2.exe, 00000003.00000003.374953800.00000000058CE000.00000004.00000001.sdmp Binary or memory string: X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-399-956364267.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E94DC7DF-3B66-4840-B094-2664865AF5FB</Name></Attribute><Attribute name="Features"><Feature>HOMECORE</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0070A9A2-8698-4D9A-926E-4774802D1E7F</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>8d9aeece
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_811.1
Source: 5924-56-983134252.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>53EF52F9-DC99-4F9E-BD2D-8C3865D82AF0</Name></Attribute><Attribute name="Features"><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373442127.0000000005966000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0002AB08-394C-4ED9-9F53-9F7671C6EB67</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>nSp
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E6BE60CE-2728-4D5C-8DCC-D413D4A4286E</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sfs64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>57D9AF84-6B6F-4805-8DB8-398BF1D829EA</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SFS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>LocalRepData</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>b36a</md5></subpackage><subpackage path8K%
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: EFF659D9</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373660335.000000000598D000.00000004.00000001.sdmp Binary or memory string: e><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>8C24392F-1494-4B88-B5F3-D5A33D319540</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_81.
Source: 5924-158-1342346970.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>434DBFC2-D59F-4511-80AB-91FEE7C5CE69</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373386063.000000000834A000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>94F72849-230F-4B7D-B34E-B78AEF0CB717</Name></Attribute><Attribute name="Features"><Feature>MTR_E</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>8LFGyUZzkwSK
Source: SophosSetup_Stage2.exe, 00000003.00000003.374161160.0000000005896000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>66B106A1-4892-4607-B1BB-6A7458C45494</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>88073DC4-4B96-482A-8141-C0A0DAEA966E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>1.7.0.19" versi=
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTAc Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DCA3AA9D-7B9C-460F-8C24-619ABE4143D4</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAE72DAC-560C-418E-A0EF-7BED3D39285B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>5></versi
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>816B56BA-7703-48BB-B0DC-AB2CE683B90C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>4
Source: 5924-74-603399662.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>D019D291-6675-4DE1-B703-E0BF46F6E121</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6C7A9D62-E4F2-4683-BF20-2D1284538E9B</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>fes
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6915CB36-032D-4C32-B936-86B6E7851153</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>Attributes>ckag2
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_8*ut
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: WIN_VISTA-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_81_SVR_X644
Source: 5924-439-409877127.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>61E1E8D8-7BF9-429A-B1B3-813B07798973</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.MLSUPP.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>11</BaseVersion><Tag>SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.MLSUPP.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>11</BaseVersion><Tag>SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C46C4A15-5A6A-4F55-8968-C102BE6CB269</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>91AE1B31-D1ED-4ABF-9387-5B1517B14576</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>RECOMMENDED</Tag><Label>5B99655E-5344-42CF-BB5C-031B26F71A66</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2021-1</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>G
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>22743DC7-F29C-4CA3-B06D-16905A872939</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>-
Source: 5924-292-1916544094.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E8C50529-A1BE-41C8-ABA1-5B56B36220B4</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.9</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_81_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>88073DC4-4B96-482A-8141-C0A0DAEA966E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.374502397.00000000082D4000.00000004.00000001.sdmp Binary or memory string: m+&#x0A;p/Hi9dT6lrrnbzBzIpe1S2/1ufAg4yfNVHQammmwCPGCrOFuKfyGDP0CIIv37b93&#x0A;3N7PEXy6nz+uUGH4a+udWCg0sC6Lp2Xvscwn2L70K+CPqVD3haa5Gt7PxlLYl+w5&#x0A;sLVrtZXPFpc15sIbxR8WxWb1i35GgPvo2cHgjasj6QIDAQABoyMwITAPBgNVHRMB&#x0A;Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQwFAAOCAgEAA8QF&#x0A;WaW4LO0qpRLGugT+bVMVKspl3Oq/eHBUP1Mf7u+i9frix+wGqVzTrbCVgrGepTHL&#x0A;W2CFuaifv73ZroIv22HouQJp2V/SjbE1SVJe/ezVKOSMtl4pgqKbLUxnZlEe5eC6&#x0A;KNoFfvMEUOzCIn2zvJpf/T8SjI4w6QnPi/nXOXjHVfCGQPfdIwBqOJ6UrSodv03K&#x0A;AZZ2aSSsHxbjWyG++bxBWeZJcwqzBcAck2ZTdr2FkIC9hvcIorfu/Yup232qwKoS&#x0A;+lgf1CsnXjJMLzPSro60nwo8LFGyUZzkwSKxBgutNSL+s6HoHVu4I0dghlZMaBXL&#x0A;TjDDfV3YtP94zydnvJ2vHQcB4k9zDkniRNtnQem6AlezpRZL/78IhGdJMXG8klYI&#x0A;ySeFXPtgv0mO8ys/LpFNw54g3buzCWvrKhSm+wtDKbQAaljU9Ly3pHnlUFUBdUdK&#x0A;09y1+OJVtDmH+37eKe22q2zLAryrX8YlUS0wgdYf50fXQrYpW+bzqAKsUGLer1ai&#x0A;e0u9E/iZKVVL2zraHBk4nnDmfADU9fdI+dyQLxGh+DQGJa9dUHrVTxhyx0RAAfjj&#x0A;PR7cfNKgCrI4jpv/HqRRJfLDTq/JkS6QFCtPFdHL6iJZk2mpMTozzrX+l9MpkeKc&#x0A;m1CcQMiY9dx9JnTrgABKFHO1JktP7enkqeP+pSo=&#x0A;-----END CERTIFICATE-----&#x0A;</xsig_intermediate_cert></extSignature></signatureFile>form>WIN_8_X64</Platform><Plat
Source: SophosSetup_Stage2.exe, 00000003.00000003.373614325.0000000005956000.00000004.00000001.sdmp Binary or memory string: _X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.repairkit_supp.xml</Warehouse><ProductRelease><ProductLine>REPAIRKIT</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.372410726.00000000058C6000.00000004.00000001.sdmp Binary or memory string: Platform>WIN_8_&
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A7D04486-D295-4B6F-B4F5-DC961EF08CBE</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: 5924-549-116252085.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BFAD2841-0E83-44EF-88C9-C474B15B0049</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: WIN_8_SVR_X64_
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>816B56BA-7703-48BB-B0DC-AB2CE683B90C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>C
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_8_SVR_X64\
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5B3B3BD-E198-48DF-82FA-55F898C68011</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.372151242.00000000082D7000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6D8DD4A5-4BCC-44C6-A58A-E7C33B198D67</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>u7kc
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8164X6464
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_8aphic Pro
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6F49F3CF-3EED-41F1-9FD3-AB897E414E70</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>xzKn
Source: SophosSetup_Stage2.exe, 00000003.00000003.371479641.0000000008123000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F1FAD658-4637-44B0-B75D-A87BD74C1A2A</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>_X64</Pla
Source: 5924-437-1728833769.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>94F72849-230F-4B7D-B34E-B78AEF0CB717</Name></Attribute><Attribute name="Features"><Feature>MTR_E</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373595987.00000000082D9000.00000004.00000001.sdmp Binary or memory string: older"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>33911418-6E92-4ADB-8536-46F59284DC6C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1D1BCA02-A923-4F57-9E7C-A3AB691407B8</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute></ReleaseAttributes>eVYXbDI8ACCfkl1v7V4yX+SzkgUS5pwcX
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A04C7C21-AA7E-4D13-ACF4-D627F28E1824</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>F
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>89663E44-04E8-4EC3-A7CE-0BEC9C89266D</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>ductLine>TEw
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>262C19A0-5214-4343-82C2-FFCCBDB1E8BE</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373386063.000000000834A000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>ED84BB34-BD3F-4C5C-8172-62D0B17D6A30</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64 Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: WIN_8_SVR_X644
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1D1BCA02-A923-4F57-9E7C-A3AB691407B8</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute></ReleaseAttributes>u
Source: SophosSetup_Stage2.exe, 00000003.00000003.368957812.000000000814E000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>EF17C457-73C5-454B-86CF-C4DD0EF6E002</Name></Attribute><Attribute name="Features"><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>e9b7
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: WIN_8_SVR_X64-
Source: SophosSetup_Stage2.exe, 00000003.00000003.369570292.0000000008151000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>liveterminal</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>EF17C457-73C5-454B-86CF-C4DD0EF6E002</Name></Attribute><Attribute name="Features"><Feature>LIVETERMINAL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVETERMINAL</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>e9b-
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_81642_SVR_
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_VISTA_X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3316C911-987B-41B4-B897-1FEAFE77E0F3</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B6122C8C-7EC4-496B-AA10-E1917320F4C6</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>RECOMMENDED</Tag><Label>5F49DC4A-8302-4C8A-9C62-1F7E0A17F56C</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>68C8235F-6264-434B-8FD2-F5764B25D641</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>K
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_8X64
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>723C5196-BCCD-44C3-A8C9-5E7149C77CF8</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.epips_data.xml</Warehouse><ProductRelease><ProductLine>EPIPS_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>61849962-D8CA-4386-88B6-4E5E7ABAC485</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>upplement
Source: SophosSetup_Stage2.exe, 00000003.00000003.374888562.0000000005981000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0A70AF40-5D95-410F-BC73-24511D126259</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>y
Source: SophosSetup_Stage2.exe, 00000003.00000003.373374819.00000000058DA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A62D2479-2A97-4E6F-A902-3142CD27C651</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>90cP
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_8ric
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0070A9A2-8698-4D9A-926E-4774802D1E7F</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>8
Source: SophosSetup_Stage2.exe, 00000003.00000003.373764674.00000000058DB000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A62D2479-2A97-4E6F-A902-3142CD27C651</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>90cJ
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C05A1975-9BCA-4C58-814B-230799943D76</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FD80148C-33FF-43F5-A801-30D51C7620E5</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>RECOMMENDED</Tag><Label>5B99655E-5344-42CF-BB5C-031B26F71A66</Label></ReleaseTag></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368322856.00000000058C3000.00000004.00000001.sdmp Binary or memory string: Platform>WIN_8_<
Source: SophosSetup_Stage2.exe, 00000003.00000003.372253634.0000000005893000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FB3FFADA-5408-49F0-B9F0-50FCC030226A</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>>3
Source: SophosSetup_Stage2.exe, 00000003.00000003.375474031.000000000834C000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B35DE857-CC95-473D-B084-702FE0A697E4</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>a3eaMMX
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sau</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FB3FFADA-5408-49F0-B9F0-50FCC030226A</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.TELEMSUPP.xml</Warehouse><ProductRelease><ProductLine>TELEMSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>d5></version></versions></rigidName>
Source: 5924-168-80335850.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>67AA052C-8319-4FF4-96DC-392B6700A903</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>E629CAD9-B6A4-47B8-8B2F-16B8FD42067B</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_8_SVR_X64R_
Source: SophosSetup_Stage2.exe, 00000003.00000003.369098789.000000000586D000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>89A149FA-F894-4249-B62A-AF4A51071198</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>orm>WIN_81</Plrre
Source: 5924-110-1104005530.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C644626C-62A8-4342-9E36-B5329289E3AC</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>CE0D5184-5D81-437B-A59A-92F7CE535CBF</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/Attribute><
Source: SophosSetup_Stage2.exe, 00000003.00000003.368343737.00000000059EA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>33911418-6E92-4ADB-8536-46F59284DC6C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-180-514423446.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A94EA5FA-5301-4CE0-A91C-DE181FDE16D6</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368322856.00000000058C3000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6915CB36-032D-4C32-B936-86B6E7851153</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2247D38-E7DE-4BEF-B6E1-6EB4B50F8462</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>a35c572bu
Source: SophosSetup_Stage2.exe, 00000003.00000003.369371671.000000000846E000.00000004.00000001.sdmp Binary or memory string: m><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>MYiuk6CQQnRxk
Source: 5924-552-657047502.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>83898130-FCFB-4C03-8678-9A4E91C8F30B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E47D3C25-AC17-4E25-8445-7964F06D034E</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>3BEBA20}
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_8
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1A5643D1-C8B7-4F2F-91DA-AAD60C3CBCC5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>rm>WIN_81_X64</++
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_7
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_7S
Source: 5924-218-845762007.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>8688AB23-AB11-49AE-B311-AAFBEF87EBF6</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_81
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_81_SVR_X64_
Source: 5924-433-1091827412.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FA8999AF-89C3-4ABC-99F9-4B2C036B7EE2</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>508B2CC3-D5D8-4595-A4B8-52B66FC44EAF</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>-w
Source: SophosSetup_Stage2.exe, 00000003.00000003.368579752.00000000083C9000.00000004.00000001.sdmp Binary or memory string: WIN_81_SVR_X64
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAE72DAC-560C-418E-A0EF-7BED3D39285B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>rsions></a
Source: SophosSetup_Stage2.exe, 00000003.00000003.373133189.00000000059B6000.00000004.00000001.sdmp Binary or memory string: atform>WIN_8
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4B1D9ECA-16E1-4647-8843-733D73138A77</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>9961EAB5-4F62-4A93-A0C8-49024F89444F</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>m
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_8X642_SVR_
Source: SophosSetup_Stage2.exe, 00000003.00000003.372151242.00000000082D7000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AF71DDDF-3308-49FE-814A-E92D1F715677</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-6</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>d36130ce4ea01c9J
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_78@
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: WIN_81l
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_8T
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: WIN_8S
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AC1A633C-383C-433B-AAEB-538EACE8CD30</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>73518AC3-CB70-4AF3-B1C4-EEC3762B328C</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>" ma
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: lWIN_7aphic Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_8J
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BC21624B-C970-42CB-97EE-4F70D97FC828</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA2</Tag><Label>E0A1004C-17C6-4D05-835B-3F2BA9642A16</Label></ReleaseTag></Attribute></ReleaseAttributes>
Source: 5924-332-1512373340.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2C0B968-EE36-4539-8E04-7F1844A62251</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA</Tag><Label>34F7D2F5-1218-4FA8-A195-7E10141688CF</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2021-1-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8_X64X644
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_808_SVR
Source: SophosSetup_Stage2.exe, 00000003.00000003.373398292.00000000082D8000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>33911418-6E92-4ADB-8536-46F59284DC6C</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369526144.00000000059C9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DCA3AA9D-7B9C-460F-8C24-619ABE4143D4</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>,
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B765C915-E3A0-4434-A5B0-F8A083FFA41F</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>BETA2</Tag><Label>A3D9ED24-2E48-4F39-8B23-2D1D0E1FD750</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-1-EAP2</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>k
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>84498E1D-3C5E-4365-8766-68A4B6A92D65</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C97D53B1-6ED5-40B4-87A8-B180BDBB570A</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>d></Versi
Source: SophosSetup_Stage2.exe, 00000003.00000003.374679174.0000000005941000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>262C19A0-5214-4343-82C2-FFCCBDB1E8BE</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ww
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_7_X64l@
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: WIN_7T
Source: 5924-352-1455969333.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B491452A-1A89-46D2-B101-BE39E37D3ECE</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.7.2</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec><
Source: SophosSetup_Stage2.exe, 00000003.00000003.369288931.00000000083C1000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E3DFE7A6-2261-42E0-AFAD-84AC9D320020</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.373865395.00000000083E9000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>71D7B766-A8F4-4D4E-BBF4-2F07F177D037</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>majorRoll
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4973BCDE-9297-4FAD-87F6-F9A1923C8772</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>4
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1D1BCA02-A923-4F57-9E7C-A3AB691407B8</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute></ReleaseAttributes>es>8e32a2a0e2bbedfc00365dfd_>5
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: rm>WIN_8_SVR
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_81ONAL@
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_8164IONo
Source: SophosSetup_Stage2.exe, 00000003.00000003.372923191.00000000059CA000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0B8D66AB-4024-4A43-B54A-1E0514D5A25C</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Pl
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>96DACFB8-B2B8-4F1D-A9ED-BE619FB962A9</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/Wareho$
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>982C1E50-2B71-4A78-A2CE-2F146F716863</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_latest</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_next</DecodePath></Supplement></Attribute></ReleaseAttributes>L
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0A6D5292-6543-4276-AB57-7A05735667A9</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>eleaseA
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2247D38-E7DE-4BEF-B6E1-6EB4B50F8462</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>89A149FA-F894-4249-B62A-AF4A51071198</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>rollOut version-id="11.6.652" X
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>264DE98E-7F79-418D-9884-20EB7D507BC1</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>22cd29d61cb81bcc65c42c1a@
Source: SophosSetup_Stage2.exe, 00000003.00000003.368322856.00000000058C3000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6915CB36-032D-4C32-B936-86B6E7851153</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>Platform>WIN_8_<
Source: 5924-627-2139634146.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><Dictionary xmlns="badger:dictionary"><Lang>en</Lang><Labels><Line><Label token="MDR32"><Short>Sophos Managed Threat Response for Windows (32-bit)</Short><Long>Sophos Managed Threat Response for Windows (32-bit)</Long></Label><Label token="MDR64"><Short>Sophos Managed Threat Response for Windows (64-bit)</Short><Long>Sophos Managed Threat Response for Windows (64-bit)</Long></Label><Label token="MTR32"><Short>Sophos Managed Threat Response for Windows (32-bit)</Short><Long>Sophos Managed Threat Response for Windows (32-bit)</Long></Label><Label token="MTR64"><Short>Sophos Managed Threat Response for Windows (64-bit)</Short><Long>Sophos Managed Threat Response for Windows (64-bit)</Long></Label><Label token="WindowsCloudMDR"><Short>Windows Cloud Managed Threat Response</Short><Long>Windows Cloud Managed Threat Response</Long></Label></Line><Name><Label token="1A7C09DF-7C99-424D-9AC6-C457806A6EF6"><Short>1.0.1.44</Short><Long>1.0.1.44</Long></Label><Label token="1D1BCA02-A923-4F57-9E7C-A3AB691407B8"><Short>2.1.0.11</Short><Long>2.1.0.11</Long></Label><Label token="22743DC7-F29C-4CA3-B06D-16905A872939"><Short>2.0.0.74</Short><Long>Sophos Managed Threat Response for Windows (32-bit) v2.0.0.74</Long></Label><Label token="24B3C54F-9E6C-498E-B427-3C007864570E"><Short>1.0.3.11</Short><Long>Sophos Managed Threat Response for Windows (32-bit) v1.0.3.11</Long></Label><Label token="2EA3933D-2237-4AB6-A270-39C5034BA926"><Short>1.0.1.44</Short><Long>Sophos Managed Detection and Response for Windows (32-bit) v1.0.1.44</Long></Label><Label token="71D7B766-A8F4-4D4E-BBF4-2F07F177D037"><Short>1.0.2.10</Short><Long>1.0.2.10</Long></Label><Label token="7C6E95D4-8F19-4FE1-B6AD-D4B2EFEF48FA"><Short>2.0.0.74</Short><Long>Sophos Managed Threat Response for Windows (64-bit) v2.0.0.74</Long></Label><Label token="979E902A-3211-407A-84AC-BC6441523BDE"><Short>2.1.0.11</Short><Long>Sophos Managed Threat Response for Windows (32-bit) v2.1.0.11</Long></Label><Label token="B35DE857-CC95-473D-B084-702FE0A697E4"><Short>1.0.3.11</Short><Long>Sophos Managed Threat Response for Windows (64-bit) v1.0.3.11</Long></Label><Label token="C05A1975-9BCA-4C58-814B-230799943D76"><Short>1.0.3.11</Short><Long>1.0.3.11</Long></Label><Label token="D7C32036-554F-4581-8B0A-A90318919E25"><Short>2.1.0.11</Short><Long>Sophos Managed Threat Response for Windows (64-bit) v2.1.0.11</Long></Label><Label token="F00EC9A6-6E45-41BA-A85D-C463A668CAF0"><Short>1.0.2.10</Short><Long>Sophos Managed Threat Response for Windows (32-bit) v1.0.2.10</Long></Label><Label token="F7A00F14-1FCE-4A74-81B3-CE0590CF0F2D"><Short>1.0.2.10</Short><Long>Sophos Managed Threat Response for Windows (64-bit) v1.0.2.10</Long></Label><Label token="FAE72DAC-560C-418E-A0EF-7BED3D39285B"><Short>2.0.0.74</Short><Long>2.0.0.74</Long></Label><Label token="FFB8E64D-5790-4D17-9230-2A32CCEEF531"><Short>1.0.1.44</Short><Long>Sophos Managed Detection and Response for Windows (64-bit) v1.0.1.44</Long></Label>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B35DE857-CC95-473D-B084-702FE0A697E4</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>00d08a00" si
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64X644
Source: SophosSetup_Stage2.exe, 00000003.00000003.372986568.0000000008123000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAB7DE62-D2AF-4448-860B-E9A158202DA1</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>h>.</SlowDecoY
Source: 5924-234-2054826735.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1A5643D1-C8B7-4F2F-91DA-AAD60C3CBCC5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-310-601292155.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0B8D66AB-4024-4A43-B54A-1E0514D5A25C</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>BETA</Tag><Label>34F7D2F5-1218-4FA8-A195-7E10141688CF</Label></ReleaseTag></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519666059.00000000080F2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E94DC7DF-3B66-4840-B094-2664865AF5FB</Name></Attribute><Attribute name="Features"><Feature>HOMECORE</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>409ee39e7db3d4eef5c720f
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>98FF74D4-439D-48CB-87AA-8D4E97FDB10E</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>/
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><package xmlns="badger:package" name="Windows Cloud AV 11.6.360" version="11.6.360"><contents><md5 extent="x000" sha384="63b6a709ca85bab92418f09048bf6cca3b4f9e3934144623fe67f53b882adba08bd1ea2210146dfbd67060241fc73150" size="947">9dc59e3e8ec8d3873e4a8582654a0358</md5></contents><subpackages><subpackage path="efw"><md5 extent="x000" sha384="a7cff0c56c811ca2c700d6bbeac6fc7eb3a7499a646c0686518c2acac50d0e7c388d466429219ba3dc62408f56c1a5c6" size="329">a776ef8811f17637be51d931f51f558f</md5></subpackage><subpackage path="efw64"><md5 extent="x000" sha384="0d5761d30e1a9034dad9659ba06390a8a76b30ea093bf35b310ae393cc9146686033ae109e0e67e30fa3156c32dad293" size="331">104a16e64afdda9b1610c84521d771c6</md5></subpackage><subpackage path="savxp"><md5 extent="x000" sha384="4252b03093cebfbc47ba7e89f0ff05ba58b797202c6fb94c8264f53e4ac754c138aa190c69133b42ba98ebc9b3135b77" size="333">a92937796366877daffadee81f71ff4c</md5></subpackage><subpackage path="savxp"><md5 extent="x000" sha384="23c38c605334f516b2cae761195aa27c5c6fc0b73cb862bd41d9b05e7c4ed0b62a48186487ef7a2f44990ceff51ae4aa" size="338">b815bcf0da4f12550210fc4d59954ef5</md5></subpackage></subpackages></package>orm>WIN_81_SVR
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>508B2CC3-D5D8-4595-A4B8-52B66FC44EAF</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>-
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_8ONAL Pro
Source: SophosSetup_Stage2.exe, 00000003.00000003.373535524.00000000080F2000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>68C8235F-6264-434B-8FD2-F5764B25D641</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>
Source: 5924-625-334498254.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>WindowsCloudMTR</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1D1BCA02-A923-4F57-9E7C-A3AB691407B8</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion /><Tag>RECOMMENDED</Tag><Label>2633B351-A970-4712-8398-871392BBA315</Label></ReleaseTag><ReleaseTag><BaseVersion /><Tag>BETA</Tag><Label>2BB76E29-0CB8-4CF8-9C61-D4BB3A530511</Label></ReleaseTag></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FB3D18E7-EF83-44C4-B8DA-A8EA451872E4</Name></Attribute><Attribute name="Features"><Feature>HOMECORE</Feature><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>extent="x00k
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>982C1E50-2B71-4A78-A2CE-2F146F716863</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_latest</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.scheduled_qp.xml</Warehouse><ProductRelease><ProductLine>ScheduledQueryPack</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>scheduled_query_pack_next</DecodePath></Supplement></Attribute></ReleaseAttributes>m
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F928CC65-2DF0-409F-B47D-474F571DE7FF</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: 5924-449-1055511338.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>41E6BFE2-CC54-42DA-BB73-0AD288007C60</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-0-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>DB9BC4B0-116C-4016-82C8-DA44EDE9D525</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>=i
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E2093F8-6D51-4325-A0B6-64E525737BA5</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>om
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>83898130-FCFB-4C03-8678-9A4E91C8F30B</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>@O
Source: SophosSetup_Stage2.exe, 00000003.00000003.371479641.0000000008123000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>uninstaller</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FAB7DE62-D2AF-4448-860B-E9A158202DA1</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_XP</Platform></Attribute><Attribute name="Roles"><Role>UNINSTALLER</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>h>.</SlowDecoC
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>01E6EE5A-ACCD-4801-9834-3C36D6860AF1</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.77.1.2</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.374839804.00000000058F8000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4344C3CE-3C2E-4B7A-B141-61473AE15A0A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>S
Source: SophosSetup_Stage2.exe, 00000003.00000002.519906808.0000000008335000.00000004.00000001.sdmp Binary or memory string: E8EF9AD8-EA98-4489-A4B7-CFD4D956723E="WIN_81_SV
Source: SophosSetup_Stage2.exe, 00000003.00000003.368483546.0000000008339000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E323553-67CC-40BE-B932-36003A18FFC9</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>K
Source: SophosSetup_Stage2.exe, 00000003.00000003.371356334.00000000058F5000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sse</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4344C3CE-3C2E-4B7A-B141-61473AE15A0A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement mode="fast"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement mode="slow"><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ixdata_slow.xml</Warehouse><ProductRelease><ProductLine>DataSetA</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>slow</DecodePath><SlowDecodePath>.</SlowDecodePath></Supplement></Attribute></ReleaseAttributes>I
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: >WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>W(b
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>BFAD2841-0E83-44EF-88C9-C474B15B0049</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>qkhHUxZS4kBkwZXV
Source: SophosSetup_Stage2.exe, 00000003.00000003.373717456.00000000058B1000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>efw</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C02FD7C9-3548-4BAE-8AE7-829A11328A72</Name></Attribute><Attribute name="Features"><Feature>EFW</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>EFW</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>53129580-32BD-44EE-BC96-A8537C6ECACA</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>m
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>shs</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>16DDB2AE-8028-4972-BF26-A196DB8D614A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>HEALTH</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: lWIN_71.1
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>B9DC90AC-3086-4950-A63F-F28B37FB8B3D</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.68.0.194</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>53E5E189-706F-440B-AF19-20B2DFBAB969</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.9</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec
Source: SophosSetup_Stage2.exe, 00000003.00000003.375113353.0000000005957000.00000004.00000001.sdmp Binary or memory string: latform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></At
Source: SophosSetup_Stage2.exe, 00000003.00000003.373946907.0000000008376000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>70C79493-EA69-4C6D-98D8-FBFD2340BB0A</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.MLSUPP.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>13</BaseVersion><Tag>SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.MLSUPP.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>13</BaseVersion><Tag>SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1213E010-0FC0-46C3-8C55-CA3B265CAE96</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.69.2.0</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sed</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5951C491-621C-4CF8-95C3-E276CAEC3476</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>SED</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.behave.xml</Warehouse><ProductRelease><ProductLine>behave</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>Config\BehavioralRules</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5C714AAE-940B-4D67-B12E-6057703D75A4</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>E629CAD9-B6A4-47B8-8B2F-16B8FD42067B</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>d
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: lWIN_81_X64IONo
Source: SophosSetup_Stage2.exe, 00000003.00000003.372410726.00000000058C6000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6476AFEC-D798-4BE4-8EB5-83F61B6FF7C7</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>0037
Source: 5924-148-844808410.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A5FC8059-D40F-455D-AFC0-73C6999FC679</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.74.1.3</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6D47A33D-6624-44AC-8EB6-6E2B30C9E88C</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="SAVVersion"><Str1024>10.8.6</Str1024></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DLP</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>SAV</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>SAV</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.CRTSUPP.xml</Warehouse><ProductRelease><ProductLine>97B6A561-5F87-4A2E-A4FE-177F48D8899F</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>crt</DecodePath></Supplement><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.hips.xml</Warehouse><ProductRelease><ProductLine>HIPS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST_CLOUD_ENDPOINT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sxl_supp.xml</Warehouse><ProductRelease><ProductLine>SXLSUP</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>2</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.APPFEED_d1.xml</Warehouse><ProductRelease><ProductLine>USERAPPFEED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>livequery64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A93CFD68-6FC3-4DE5-BF20-8258D275BF3D</Name></Attribute><Attribute name="Features"><Feature>LIVEQUERY</Feature><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>LIVEQUERY</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>xml<X
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A0C413BD-6E5E-4828-8554-056ABEAA9E37</Name></Attribute><Attribute name="Features"><Feature>AV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cepng_flags.xml</Warehouse><ProductRelease><ProductLine>CEPNGFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>2020-5</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>b93d51160a278b<
Source: SophosSetup_Stage2.exe, 00000003.00000003.369408409.000000000833E000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>hmpa</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E323553-67CC-40BE-B932-36003A18FFC9</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>XPD</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.hmpa_data.xml</Warehouse><ProductRelease><ProductLine>hmpa_data</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion>1</BaseVersion><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>@
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: lWIN_81ONAL
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sme</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>5E9E1CB1-ABA6-4BE4-83DA-00F679302D4B</Name></Attribute><Attribute name="Features"><Feature>XPD</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>s>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: Windows 2008 R2</Long></Label><Label token="WIN_7"><Short>Win7</Short><Long>Windows 7</Long></LaU
Source: SophosSetup_Stage2.exe, 00000003.00000003.373745769.00000000058C6000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>sdu</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6476AFEC-D798-4BE4-8EB5-83F61B6FF7C7</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>SDU</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>003-
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>1213E010-0FC0-46C3-8C55-CA3B265CAE96</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.69.2.0</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>V
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A8BF9C01-4EFC-4B20-933B-208CCCF7D56A</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>ctionaries><las
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0070A9A2-8698-4D9A-926E-4774802D1E7F</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>NEXT</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>es"><TargetType
Source: SophosSetup_Stage2.exe, 00000003.00000003.369389051.0000000008483000.00000004.00000001.sdmp Binary or memory string: WIN_8_X64X64_
Source: SophosSetup_Stage2.exe, 00000003.00000003.373831852.00000000083CA000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>dotnet</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>C468B8AA-478F-484D-86FB-74519C53833B</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>AC1A633C-383C-433B-AAEB-538EACE8CD30</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>esh64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>508B2CC3-D5D8-4595-A4B8-52B66FC44EAF</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>CORE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.ESHSUPP.xml</Warehouse><ProductRelease><ProductLine>07A049D2-0CC4-4E42-8EE8-5C31194954ED</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>law
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>FD80148C-33FF-43F5-A801-30D51C7620E5</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>11</BaseVersion><Tag>RECOMMENDED</Tag><Label>5B99655E-5344-42CF-BB5C-031B26F71A66</Label></ReleaseTag></Attribute></ReleaseAttributes>e="331<
Source: SophosSetup_Stage2.exe, 00000003.00000003.373133189.00000000059B6000.00000004.00000001.sdmp Binary or memory string: latform>WIN_XP</Platform><Platform>WIN_XP_X6
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mdr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>2EA3933D-2237-4AB6-A270-39C5034BA926</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MDR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.372914659.00000000059C5000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUD</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F2169BEB-6662-4D62-BF37-E2F4329DDEBA</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.369297683.00000000083F3000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E47D3C25-AC17-4E25-8445-7964F06D034E</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>8f}
Source: SophosSetup_Stage2.exe, 00000003.00000003.368611281.0000000008430000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6280BDF7-6AD6-4D33-A3AF-AB6B306916A3</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>F16BFA31-3FAF-41B8-B326-0E80B924B6D4</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.77.1.28</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>positor$$
Source: SophosSetup_Stage2.exe, 00000003.00000003.374233025.000000000833B000.00000004.00000001.sdmp Binary or memory string: </Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.367900018.00000000058B2000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>0A6D5292-6543-4276-AB57-7A05735667A9</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.79.0.22</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>eleaseA
Source: SophosSetup_Stage2.exe, 00000003.00000002.508907859.000000000586D000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mcsep</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>3A5E6E63-B258-4FDB-B79F-FF0349E12939</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>MCS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>pm
Source: SophosSetup_Stage2.exe, 00000003.00000003.374440387.000000000831B000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ESHSXP</Str1024></Attribute><Attribute name="EMLVersion"><Str1024>0.0.0</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>593D0AAB-EB57-4C56-89FD-50F8184BA570</Name></Attribute><Attribute name="Features"><Feature>APPCNTRL</Feature><Feature>AV</Feature><Feature>DVCCNTRL</Feature><Feature>HIPS</Feature><Feature>PUA</Feature><Feature>WEBCNTRL</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>EPS</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.sdu.xml</Warehouse><ProductRelease><ProductLine>SDU</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>RECOMMENDED</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sdu</DecodePath></Supplement></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.370929203.00000000058FC000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ntp64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>6C7A9D62-E4F2-4683-BF20-2D1284538E9B</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000003.368031998.000000000838F000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>55C0B7F5-D5E7-46EF-84F6-AC917A4371F5</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>BETA</Tag><Label>C23FDE4D-B3E9-4CFF-BA35-4F3CEBCC558C</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-1-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/up
Source: SophosSetup_Stage2.exe, 00000003.00000003.373884092.00000000083FA000.00000004.00000001.sdmp Binary or memory string: rsion="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>enc</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>E47D3C25-AC17-4E25-8445-7964F06D034E</Name></Attribute><Attribute name="Features"><Feature>DISKENCRYPTION</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>ENCRYPTION</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>8fg
Source: SophosSetup_Stage2.exe, 00000003.00000003.373632324.0000000005940000.00000004.00000001.sdmp Binary or memory string: 570A</Name></Attribute><Attribute name="Features"><Feature>AV</Feature><Feature>NTP</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>NTP</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>d></Versi
Source: SophosSetup_Stage2.exe, 00000003.00000003.368524342.0000000008302000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>savxp</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>01E6EE5A-ACCD-4801-9834-3C36D6860AF1</Name></Attribute><Attribute name="SAVLine"><SAVLine>SAVEEXP</SAVLine></Attribute><Attribute name="VirusEngineVersion"><Str1024>3.77.1.2</Str1024></Attribute><Attribute name="Features"><Feature>SAV</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2003_SVR</Platform><Platform>WIN_2003_SVR_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2008_SVR</Platform><Platform>WIN_2008_SVR_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform><Platform>WIN_VISTA</Platform><Platform>WIN_VISTA_X64</Platform><Platform>WIN_XP</Platform><Platform>WIN_XP_X64</Platform></Attribute><Attribute name="Roles"><Role>VE</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d2.sophosupd.com/update</Repository><Repository>http://d2.sophosupd.net/update</Repository><Warehouse>sdds.VDB_supp.xml</Warehouse><ProductRelease><ProductLine>VDL</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>LATEST</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement></Attribute></ReleaseAttributes>>8d2482ddf08e1efx000.xml
Source: 5924-543-1568211497.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDENC</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>A04C7C21-AA7E-4D13-ACF4-D627F28E1824</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: lWIN_VISTA
Source: SophosSetup_Stage2.exe, 00000003.00000002.519821611.00000000082D0000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>CLOUDHMPA</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>55C0B7F5-D5E7-46EF-84F6-AC917A4371F5</Name></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_7</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute><Attribute name="ReleaseTags"><ReleaseTag><BaseVersion>1</BaseVersion><Tag>BETA</Tag><Label>C23FDE4D-B3E9-4CFF-BA35-4F3CEBCC558C</Label></ReleaseTag></Attribute><Attribute name="Supplements"><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>995645D3-DA2A-407E-AC5D-7267B8B43975</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme\telemetry</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_SCAN</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\scan</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/update</Repository><Warehouse>sdds.ml_models.xml</Warehouse><ProductRelease><ProductLine>C19A85E4-728F-4E92-8528-6B42B30639B2</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>USER_TELEM</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>sme64\telemetry</DecodePath></Supplement><Supplement><Repository>http://d1.sophosupd.com/update</Repository><Repository>http://d1.sophosupd.net/update</Repository><Warehouse>sdds.cix_flags.xml</Warehouse><ProductRelease><ProductLine>CIXFLAGS</ProductLine><VersionSpec type="generic"><ReleaseTagId><BaseVersion /><Tag>3-8-1-EAP</Tag></ReleaseTagId></VersionSpec></ProductRelease><DecodePath>.</DecodePath></Supplement><Supplement><Repository>http://d3.sophosupd.com/update</Repository><Repository>http://d3.sophosupd.net/up
Source: 5924-246-1990318925.3.dr Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>ui64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>4E0ABE04-A0B9-436A-80DE-629B7B05E667</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_2011_SVR_X64</Platform><Platform>WIN_2012_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="Roles"><Role>UI</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
Source: SophosSetup_Stage2.exe, 00000003.00000002.519997772.0000000008396000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>mtr32</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>24B3C54F-9E6C-498E-B427-3C007864570E</Name></Attribute><Attribute name="Features"><Feature>MDR</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10</Platform><Platform>WIN_7</Platform><Platform>WIN_8</Platform><Platform>WIN_81</Platform></Attribute><Attribute name="Roles"><Role>MTR</Role></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>-
Source: SophosSetup_Stage2.exe, 00000003.00000003.368471836.00000000058D9000.00000004.00000001.sdmp Binary or memory string: <?xml version="1.0" encoding="utf-8" ?><ReleaseAttributes xmlns="badger:ReleaseAttributes"><Attribute name="DefaultHomeFolder"><Str1024>clean64</Str1024></Attribute><Attribute name="Lifestage"><Lifestage>PROVISIONAL</Lifestage></Attribute><Attribute name="Name"><Name>CBFC0043-2DCA-4338-89F5-A29E2969F84A</Name></Attribute><Attribute name="Features"><Feature>CORE</Feature></Attribute><Attribute name="Platforms"><Platform>WIN_10_SVR_X64</Platform><Platform>WIN_10_X64</Platform><Platform>WIN_2008_R2_SVR_X64</Platform><Platform>WIN_7_X64</Platform><Platform>WIN_8_SVR_X64</Platform><Platform>WIN_8_X64</Platform><Platform>WIN_81_SVR_X64</Platform><Platform>WIN_81_X64</Platform></Attribute><Attribute name="TargetTypes"><TargetType>ENDPOINT</TargetType></Attribute></ReleaseAttributes>
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 413056 Sample: SophosSetup (9).exe Startdate: 13/05/2021 Architecture: WINDOWS Score: 10 6 SophosSetup (9).exe 3 2->6         started        file3 16 C:\Users\user\AppData\Local\...\Setup.exe, PE32 6->16 dropped 9 Setup.exe 32 6->9         started        process4 dnsIp5 26 8.8.8.8 GOOGLEUS United States 9->26 28 52.33.249.100 AMAZON-02US United States 9->28 30 184.30.25.172 AKAMAI-ASUS United States 9->30 18 C:\Program Files (x86)\...\su-setup64.exe, PE32+ 9->18 dropped 20 C:\Program Files (x86)\...\su-setup32.exe, PE32 9->20 dropped 22 C:\...\SophosSetup_Stage2.exe, PE32 9->22 dropped 24 2 other files (none is malicious) 9->24 dropped 13 SophosSetup_Stage2.exe 4 529 9->13         started        file6 process7 dnsIp8 32 54.70.128.94 AMAZON-02US United States 13->32 34 2.20.142.209 AKAMAI-ASN1EU European Union 13->34 36 192.168.2.1 unknown unknown 13->36
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
8.8.8.8
 unknown United States
15169 GOOGLEUS false
184.30.25.172
 unknown United States
16625 AKAMAI-ASUS false
54.70.128.94
 unknown United States
16509 AMAZON-02US false
2.20.142.209
 unknown European Union
20940 AKAMAI-ASN1EU false
52.33.249.100
 unknown United States
16509 AMAZON-02US false

Private
IP
192.168.2.1