ProtectDetails 000d:integrity.dat 0005:1.0.9 000e:Sophos Limited 0003:SAV 000a:10.8.9.610 2020-09-25T11:06:18Z
ProtectService 000a:SavService 10 2 1 0037:%SophosProgramFiles32%\Sophos Anti-Virus\SAVService.exe ObjectName 0019:NT AUTHORITY\LocalService Group 0008:PlugPlay DependOnService 0005:RPCSS FailureActions 003e:08070000000000000000000002000000140000000100000000000000000000
ProtectService 000f:SavAdminService 10 2 1 003c:%SophosProgramFiles32%\Sophos Anti-Virus\SAVAdminService.exe ObjectName 000b:LocalSystem FailureActions 003e:08070000000000000000000002000000140000000100000000000000000000
ProtectService 000b:SAVOnAccess 2 1 1 002d:%SystemRoot%\system32\Drivers\savonaccess.sys DependOnService 0006:FltMgr
ProtectService 0010:SophosBootDriver 2f 4 0 0032:%SystemRoot%\system32\Drivers\SophosBootDriver.sys
ProtectApplication 0029:%SystemRoot%\system32\SophosBootTasks.exe
ProtectApplication 0032:%SophosProgramFiles32%\Sophos Anti-Virus\ssr32.exe
ProtectApplication 0032:%SophosProgramFiles32%\Sophos Anti-Virus\ssr64.exe
ProtectRegKey 0021:%HKLMSophosSoftware32%\SAVService RecursiveReadOnly
ProtectRegKey 0032:%HKLMSophosSoftware32%\SAVService\Telemetry\Driver AllowChangeValues
ProtectRegKey 0033:%HKLMSophosSoftware32%\AutoUpdate\Plugins\SAVPlugin RecursiveReadOnly
ProtectRegKey 0037:%HKLMSophosSoftware32%\AutoUpdate\Plugins\SAVUserPlugin RecursiveReadOnly
ProtectRegKey 0051:%HKLMSophosSoftware32%\AutoUpdate\Products\{E17FE03B-0501-4aaa-BC69-0129D965F311} RecursiveReadOnly
ProtectRegKey 004c:%HKLMSophosSoftware32%\Remote Management System\ManagementAgent\Adapters\SAV RecursiveReadOnly
ProtectRegKey 003e:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\SavService RecursiveReadOnly
ProtectRegKey 0043:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\SavAdminService RecursiveReadOnly
ProtectRegKey 003f:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\savonaccess RecursiveReadOnly
ProtectRegKey 0044:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\SophosBootDriver RecursiveReadOnly
ProtectRegKey 006b:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\TamperProtection\Components\SAV RecursiveReadOnly
ProtectRegKey 0070:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\TamperProtection\Services\SavService RecursiveReadOnly
ProtectRegKey 0075:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\TamperProtection\Services\SavAdminService RecursiveReadOnly
ProtectRegKey 0071:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\TamperProtection\Services\savonaccess RecursiveReadOnly
ProtectRegKey 0076:\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\TamperProtection\Services\SophosBootDriver RecursiveReadOnly
ProtectDirectory 0028:%SophosProgramFiles32%\Sophos Anti-Virus RecursiveReadOnly
ProtectDirectory 0025:%SophosProgramData%\Sophos Anti-Virus RecursiveReadOnly
ProtectDirectory 002e:%SophosProgramData%\Sophos Anti-Virus\INFECTED AllowChangeFiles
ProtectDirectory 0027:%SophosProgramData%\Sophos Data Control RecursiveReadOnly
ProtectDirectory 0029:%SophosProgramData%\Sophos Device Control RecursiveReadOnly
ProtectDirectory 002c:%SophosProgramData%\Sophos Tamper Protection RecursiveReadOnly
ProtectDirectory 001e:%SystemRoot%\system32\SophosAV RecursiveReadOnly
ProtectDirectory 001e:%SystemRoot%\SysWOW64\SophosAV RecursiveReadOnly
AttestFile 0012:AppFeedManager.dll 530072 12df26507a19a9b0f6cdbc7ede2ccfef111d5040e7a152f7e1072957a464185b
AttestFile 0019:ApplicationManagement.dll 478880 5161da857491301ff84f211ff048fb65033360bcd96e6f0af081b0621e2559a9
AttestFile 0013:AuthorisedLists.dll 314696 447670b903233f1bcba58e43a5fdbc44fc54fd262dc35470cef16a78b2c0c2bc
AttestFile 0018:BackgroundScanClient.exe 75552 ab65554b1bd1bef92c119460cb4d5fb487917a77d4d02731c21979166a9aa5f5
AttestFile 0016:BackgroundScanning.dll 96208 fd9ce6b113f681c7c26bfed68a0f3e7d8c6250385d58143b7c2b0ae2034310c7
AttestFile 0011:BHOManagement.dll 404536 36077056c4b54e6d87eadd695e7f4c9218cfc6dfa3a470fe8e08f57caec27cf6
AttestFile 000e:Categories.dll 15064 a5362a1b0be110fa965e409e4bb48f7a5cfe7d85d3cf8870b0f2f142dd1c7a94
AttestFile 0014:ComponentManager.dll 117384 997b01856e7699639e3474702a75f47232b2c3225e5b07aeb2aded5eac66d525
AttestFile 0011:Configuration.dll 369912 3628823ed73911150a19b56084e15699b33310f3e22ed82b8c35ceba499a3ef8
AttestFile 0019:DataControlManagement.dll 791408 fa019757e3e43bf4c4eb78a35b61b83a470efa64ea1897fd968c9aa159ead7fb
AttestFile 0015:DataControlPlugin.dll 296048 1b315db62958e6ffe9a742edc1d9048704e6701de303c302b3d97eff0ea72507
AttestFile 0010:DCManagement.dll 181920 b930ce8703a6a0c47ef7b674f808cf56bc9a849cc4e973c138db5f45f8b1ad6c
AttestFile 0014:DesktopMessaging.dll 520744 d7ad75fa58f2e07c427d1bf8c6fcab9a6ababc7d38ec72a6e26be2e7245119be
AttestFile 0015:DetectionFeedback.dll 260432 4b72aee80c9cf47937e993966d7ac858e5291c82bede632400a81a43420efa74
AttestFile 0017:DeviceControlPlugin.dll 317728 845295c4341b987d1f7c99300d9f8bc5c275baef082400e77155be75815e5c26
AttestFile 0012:DriveProcessor.dll 166928 287734e5464a23f5a5dbd1b4d06842d0000a74f2b074bf3a9b3a718b7a682364
AttestFile 000e:EEConsumer.dll 131824 e7c5a83f0df78f168f041518bd1fc1edaa2f07fdc73ae6fc31d033bb0a627429
AttestFile 0014:FilterProcessors.dll 265112 ac73013ec67ee394faabb54b7d9a116f7a58b1e3b14d882e1606644c5d4390d0
AttestFile 001b:ForceUpdateAlongSideSGN.exe 291368 775785516dc17aecbb781314634493be5dce4ee98b88c74a052ed29169b0778d
AttestFile 0010:FSDecomposer.dll 111128 87656f7e7f4c074a2f304d6090c7c62e27cc9da9421aaa9337b45c2831d20f0b
AttestFile 000d:ICAdapter.dll 267632 027c5c9baff1008d5cead0f7349223eb654b7081bdd57ff4530a4f147687cada
AttestFile 0010:ICManagement.dll 696920 5ae4593e2b696cfd3259df7ebf54f00811a2947cdb828b87da8dbad98fd957ac
AttestFile 0010:ICProcessors.dll 369432 120ea9abaab69ecca443bbde67cd5ca5df71d6fa9a90bf22958980fe39180d4f
AttestFile 0013:Instrumentation.dll 77560 d93dd4ea88e372eb0b4620af75d8c55a81cb70eb1563a9251f61554329c07b65
AttestFile 0013:LegacyConsumers.dll 120968 b9056290021fc8a9df8d0db45fa77f340a7cc3da64cc9a2139b6148106df253a
AttestFile 0010:Localisation.dll 148392 bfd39c7205366b9c5b5a5e94668634c9d3fca925d53789e03dc09755a2d9d607
AttestFile 000b:Logging.dll 522832 eac678667d4e49b5634a48b3b87b1c5f0cb68292c6a8d65b8692867676f81ffe
AttestFile 000f:Persistance.dll 118368 d1a5764f6c37ca891c9eaf888ae1b28f269bd6565cb3a3072cff9041a939b96e
AttestFile 000f:safestore32.dll 1699752 43f3c311dd28d8224759ad692fecb9703f89676c495cc05d89f063434188b2fc
AttestFile 000f:safestore64.dll 2278520 bd181c81bd85fff98732c35189a1c767dec7fddc03815094b15cef33a7940499
AttestFile 000c:sav32cli.exe 528896 b743841d96112b1722b9805f68b9614acd5ef5a78caf2291b9f37b5c49e19e5a
AttestFile 000e:SavAdapter.dll 1613640 4c383c983a512c48c0aa6bbe1a29f3ba193ff4d8d241575c495b28bceb771b06
AttestFile 0013:SAVAdminService.exe 300688 3d4f86755257e332390e2f2ce8a73936d7687944b1260d4f671ec5bd8c0b8b34
AttestFile 0015:SAVCleanupService.exe 162288 74c3e443eea5bfe538c33f6a3fd927288ad8ef0271746ce9daaae70642deb2a7
AttestFile 000e:SAVControl.dll 232056 02737c886bcb2c253888ee23bac0c65ab2e98e99914ae283c32d1ed4832356dd
AttestFile 000b:SavMain.exe 1731424 e9ec4a6d81d655f48ddc7e83245e80e8db64348a10494c3f68214850cf483e72
AttestFile 0011:SavNeutralRes.dll 3207568 3c80bfcbbc099e89697aadd103898cecd3cb6f26289204e729b8b17ce50c4adb
AttestFile 000d:SavPlugin.dll 140600 729ec8a2925118e8b02808211b9c20542c14df9e23820b8c9b9882a54c43d1a6
AttestFile 000f:SavProgress.exe 489264 39812b14621078d05e6f49e711d7e13cde4e043394c4a2fe9ac15c497de6be64
AttestFile 000a:SavRes.dll 767096 d998211012eb0eea68eb5934b7d97456084aa0de487b7b70e9587f6276f2889e
AttestFile 000d:SavResChs.dll 135920 b192b63abf57a77099e01fa3bc9a390c3e0e86f96d4ebbc83190131819c6a780
AttestFile 000d:SavResCht.dll 135408 b024d6983ba05ebfb9e9161cc3a6f8a2a59919f5d1b1296f57f35df8991eca35
AttestFile 000d:SavResDeu.dll 195344 45ef7b542b53915f2c70e11bb116628886dbabbc0e6472941defa45698bf34b0
AttestFile 000d:SavResEng.dll 187080 a5b68cf953027e5cfdcc642913d6527361ebcb8ae649973f41a0daa1889b5e2e
AttestFile 000d:SavResEsp.dll 195344 a49c43b8eba14fd8095d1f5cf3a2f20e8ab0fa35721e6090cfdee83d307bfdd9
AttestFile 000d:SavResFra.dll 206168 cad883bfebd418bea2d5d8ac7dcbe0a5a92d2d119b9dbd3095ef915a2a800eff
AttestFile 000c:SavResIt.dll 201520 8ab5d09f5c352f920aa3c8bb5b0f0956adbfecf3675aee5e23bed19d6397edc4
AttestFile 000d:SavResJap.dll 150400 99a0cfe2c887bdb43788ea5b89d9c9c2037e151e8b471a556ce992df9f7ef4df
AttestFile 000f:SavSecurity.dll 156584 b568e55a417ce126ad7000551323f76ec86529ccb5e2d28e80753188b10c6548
AttestFile 000e:SAVService.exe 217064 4829487b792ccd6444698707e8237cc08563a8a5b97063af6e9384b5855f53d2
AttestFile 000f:SavShellExt.dll 418504 42e922c7fa419e12ee91a80b25cc27ff0ebd4d03bc1cf872d85779402dab9fa5
AttestFile 0012:SavShellExtX64.dll 536760 b1fc4a2f5d236ce028fbf9994c42a3f29122c506dd7528a1810248d75a2dd485
AttestFile 000c:SAVTelem.exe 64728 0288291d0ca1c7305b5485b80544146c6a2eff40dd28c15b6bc53c24f90abe42
AttestFile 0012:SAVUserContext.dll 118440 b4a310439223d777db166c937414ce14bc8b47ccaf728455096648a3a9525ed8
AttestFile 0013:ScanEditExports.dll 49184 32daf9f44116eaf2358a291e75c13da2f21264a1b174aa2aabedcb6f65bb4a84
AttestFile 0012:ScanEditFacade.dll 215488 9911fa66574583b6c39bb3f5137ec021716ec78948abdb9ea971e0ddb6620488
AttestFile 0012:ScanManagement.dll 340512 b82b8a1954ef5a1ee69e40d24e7c9da59375b77df9a3e734d2b75111990029e0
AttestFile 0011:SEDManagement.dll 398320 9b7879160f86cb424f12c259c85f72835b8a1f2a4558248c1d216e0891a49e56
AttestFile 0012:SIPSManagement.dll 839424 2d4db4cbe050d5b736f369821d735b8febee8f3129182baddba1846fca45cc11
AttestFile 0012:SophosOfficeAV.dll 169528 c76557ee4f80bd037022ee3ebe20652d39e5eed7e99aea041d6c89ceb8adec3b
AttestFile 0015:SophosOfficeAVx64.dll 206712 538d0084d7b63e26a333311efc9317bf256699001e84aebe3b70b7c0b6cc0aa9
AttestFile 0013:sophos_detoured.dll 247328 16b056cbd50183dbf60cdce910c2f0f22cc8ad2e22fbad94ebcd0a6b2327b38e
AttestFile 0017:sophos_detoured_x64.dll 243200 2391e13fbbe8df0cc542379114de9c951ba180d2ab6a930abb7bb7dc5c3a5f6e
AttestFile 0015:SophtainerAdapter.dll 82752 81300357e8108c508b506243c63fc9104883c182f2ecb4440ae42d3862f0d55d
AttestFile 0009:ssr32.exe 151096 59f6a21bb31fbfe4909945567f0ede3b34685cde78f5a72aea3074a677c8f5b1
AttestFile 0009:ssr64.exe 173928 b45a23cafe1326779bb2d72059907abc1c579bbe7cebf67c614224fb0d1dc04d
AttestFile 0011:SWIManagement.dll 317768 15db1a6a38330368b6b4b21050ae00cf620fd92f6bd93166984729ab4b2f00fd
AttestFile 0015:SystemInformation.dll 130768 7a12fbcee255e31f54c0fddb4f2c6120070227ef18f48bfc025258e46a346e70
AttestFile 001b:TamperProtectionControl.dll 144736 c08a764889dc8fc623a5e4928443c11320700f5ae14391a96e4e4c023755cb36
AttestFile 001e:TamperProtectionControlX64.dll 169560 4b19a0553f48ca8e8f074b2212805617b0effb2976b9f58e279b5aa031424f86
AttestFile 001e:TamperProtectionManagement.dll 234064 fe56a0ea6acb026283e22da1cb0e1e650c27cc514ec981b215ee6dc4e4e2559a
AttestFile 001a:TamperProtectionPlugin.dll 277432 00facd73d34a88d9e7e7361322371e1e603dc69a0dc12dbd5ac342a477b919ec
AttestFile 0013:ThreatDetection.dll 599768 f5b64595b5ab9a87951f3c99023e9e24d23d17ee1cdaeeffb1475fbccb56f0e6
AttestFile 0014:ThreatManagement.dll 869336 452f0607ca20b98db771b0c6c2b285c7031d84976304998adb126d2a44881d2c
AttestFile 000f:Translators.dll 228432 595ed9440541e065001eeecda273a7e3ea59f5256431987c496bfdfd52fe5c8d
AttestFile 0010:VEController.dll 271768 300dad1ebfb5c56ff552dbb1600bf559696808b7753d95d56c64259d84b28507
AttestFile 0012:VirusDetection.dll 1099736 797a6a2c0ca696672d0a0ead03fcfa10aecea1e9d9898d8446b8cf3b1d054ec0
AttestFile 000d:WSCClient.exe 520480 bc90666ffd0102adf291b7c84a767d115fba611ccd381bd2a9196f4c743691cb
AttestFile 0009:BPAIF.dll 265480 22c29b375bb30ebae08180b12bf68d953681773cc22549fd481ccfd6a636f6a5
AttestFile 0014:SophosBootDriver.sys 45840 6fed9b03cfbdb941b668c1f1dc87933ebe6cfb016c469ba5a7c756761506c51c
AttestFile 0013:SophosBootTasks.exe 52440 ddd266862cf720119a6f6a0f222aa435504a43cb7fb697d114e87333f75fe259
AttestFile 0014:SophosBootDriver.sys 42200 02c34c00f3cea08c74e705033c469bcbd3e456fb02f8868d765ee9ac3e831830
AttestFile 0013:SophosBootTasks.exe 48224 95b63c2a75aace14a7de1268b3c82d34afdae09d6a41de6f0a43a84bed9f19b8
AttestFile 0014:SophosBootDriver.sys 27904 a9e3910ebefc8674704f42c6d43a12a521c212b911d46fcd669d8aafa8381c55
AttestFile 000b:skmscan.sys 52616 af97fbbef53579e2c025809dcfea76cdfdbada497ff6159ab891215953b1d6da
AttestFile 000f:savonaccess.sys 216280 283774d7938e3c7a8760f1956c9a39a8ef78828249741469dc8b7031f930e5e4
AttestFile 000f:savonaccess.sys 164680 59c56d70126f450fdc99d6e6f8f4a724a488e8bb6591013d8865a4ce615280e9
AttestFile 000f:savonaccess.sys 158976 ff2bb46f1ebcaf567b313a210a599b1794a5faf1c766ec96f33a694b0eabf3e6
AttestFile 000f:savonaccess.sys 134912 cef3f0166df3f67adaf3bde8e1335b872d8bcd086792601642d733c30cca856c
AttestFile 0015:savonaccessfilter.sys 39168 01abccb7b5510e08f663944bfa574230712c8a6970c9236c9d9151f80ce06389
AttestFile 000d:sdcfilter.sys 38144 ef608efbf72af48efc9352fcedf0523bdba6055612ffd22654e3b241aa9c8033
AttestFile 000d:sdcfilter.sys 34560 4145e8e5736359697e40e391b7831374db8e1e57cb7b1209b09f1729e2f4245e
AttestFile 000d:sdcfilter.sys 38144 ef608efbf72af48efc9352fcedf0523bdba6055612ffd22654e3b241aa9c8033
AttestFile 000d:WSCClient.exe 630072 80dc5dedf3468944a46f56796b62f7f2b07fb9302d653555adb600d730346964
DigitalSignature 0005:TP001 RSA-2048_SHA-256 0158:QFcHTmZ48JB7E+h5SKfxTtNS1pjKeH381u+5wRr/Z6lPVsNVVtN5OA8vn4Zi2KkkKPMmDw7oylMpU5laaMI3nlanx7ktGWXGOTLU/97k9xRhTuyXWpOrdtAHsbIYa6sjRgcm2b1IAcLp1Zp8aq2xKEoe6/o6/xqlHILOfJCRzeE0ImF4rgKYiBVe+wlZdm1k2ubu8IEQQF3C8ly3imCXnK88EFCy2QdMGfVLS6J1LOGvcYLUndsG3uARu6bCXocNi67Bdm7fqc5KBgkAhNnLiJfwZEpU4CJgRZvVvORZI7Ieaj01FnI3S7/9GRn8TNMNW9mk0yd++VUV5cnvr3ASFw==