1e4dd9a460ef75c4f039728249234d53b5e4a02b8ba540d6398226b8850878ec

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 30.5MB
Sample260415-pgp2msgt2s
SHA256 1e4dd9a460ef75c4f039728249234d53b5e4a02b8ba540d6398226b8850878ec
MD5 56b551ada723958bf24b716d64324c0d
SHA1 e4ede153301cc1fdea92b505f925d473a18c0201
SHA512 f44731b1e6090f240be09c88f81604c81dde7c0105fbd6606749ac914ce0c5d58a1d3ec125bf55fc9d19c6a5b489699294a1b89f0692c9409c9b3ad167544821
SSDEEP 786432:uvTndBtE0s9eI1plRh1YiVkCP4DeOPqQjM0c0agSh4ymJ:urdM0aeI1pJtVkde+j2JhhM
TLSH
T158672222BA41C031D49D01B1E56E9BF78A3D6C34C77045DBA7D13E69B9312D23B3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1652	stadrv6x64.sys
1864	stAgentUI.exe
1384	stadrv6x64.sys

Loads dropped DLL 19 IoCs

pid	Process
2992	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
1404	MsiExec.exe
4036	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe
2968	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2888	msiexec.exe
3	2888	msiexec.exe
4	2888	msiexec.exe
5	2888	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\chromehelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nspacparser.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tloader.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tramp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.sys	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx32.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfium.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_hook_hlp.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx32ipc.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-fr.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp-collect.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-de.json	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfprinterx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	msiexec.exe
File opened for modification	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfprinter.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp-collect.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker32.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp_man.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64ipc.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker32.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinterx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.inf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_text_extractor.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFAB8821D9D7FBDAAB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-sl.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIB143.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-uk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIB446.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-gu.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI9180.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-kn.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI91A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB192.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_954698782\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-ka.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e588eae.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9066.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1C3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-sv.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIAB63.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC1C7DE7012F19815.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAED1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_954698782\crl-set	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIAE04.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-pa.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIAE24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1C2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-de-1996.hyb	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2888	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207293017006331"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a6d9cdad-0000-0000-0000-d01200000000}	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a6d9cdad-0000-0000-0000-d01200000000}\MaxCapacity = "13092"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a6d9cdad-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	MsiExec.exe
3700	MsiExec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3176	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	1028	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeMachineAccountPrivilege	2888	msiexec.exe
Token: SeTcbPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeLoadDriverPrivilege	2888	msiexec.exe
Token: SeSystemProfilePrivilege	2888	msiexec.exe
Token: SeSystemtimePrivilege	2888	msiexec.exe
Token: SeProfSingleProcessPrivilege	2888	msiexec.exe
Token: SeIncBasePriorityPrivilege	2888	msiexec.exe
Token: SeCreatePagefilePrivilege	2888	msiexec.exe
Token: SeCreatePermanentPrivilege	2888	msiexec.exe
Token: SeBackupPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeDebugPrivilege	2888	msiexec.exe
Token: SeAuditPrivilege	2888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2888	msiexec.exe
Token: SeChangeNotifyPrivilege	2888	msiexec.exe
Token: SeRemoteShutdownPrivilege	2888	msiexec.exe
Token: SeUndockPrivilege	2888	msiexec.exe
Token: SeSyncAgentPrivilege	2888	msiexec.exe
Token: SeEnableDelegationPrivilege	2888	msiexec.exe
Token: SeManageVolumePrivilege	2888	msiexec.exe
Token: SeImpersonatePrivilege	2888	msiexec.exe
Token: SeCreateGlobalPrivilege	2888	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2888	msiexec.exe
Token: SeMachineAccountPrivilege	2888	msiexec.exe
Token: SeTcbPrivilege	2888	msiexec.exe
Token: SeSecurityPrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeLoadDriverPrivilege	2888	msiexec.exe
Token: SeSystemProfilePrivilege	2888	msiexec.exe
Token: SeSystemtimePrivilege	2888	msiexec.exe
Token: SeProfSingleProcessPrivilege	2888	msiexec.exe
Token: SeIncBasePriorityPrivilege	2888	msiexec.exe
Token: SeCreatePagefilePrivilege	2888	msiexec.exe
Token: SeCreatePermanentPrivilege	2888	msiexec.exe
Token: SeBackupPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeShutdownPrivilege	2888	msiexec.exe
Token: SeDebugPrivilege	2888	msiexec.exe
Token: SeAuditPrivilege	2888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2888	msiexec.exe
Token: SeChangeNotifyPrivilege	2888	msiexec.exe
Token: SeRemoteShutdownPrivilege	2888	msiexec.exe
Token: SeUndockPrivilege	2888	msiexec.exe
Token: SeSyncAgentPrivilege	2888	msiexec.exe
Token: SeEnableDelegationPrivilege	2888	msiexec.exe
Token: SeManageVolumePrivilege	2888	msiexec.exe
Token: SeImpersonatePrivilege	2888	msiexec.exe
Token: SeCreateGlobalPrivilege	2888	msiexec.exe
Token: SeCreateTokenPrivilege	2888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2888	msiexec.exe
Token: SeLockMemoryPrivilege	2888	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2888	msiexec.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe
1864	stAgentUI.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2992	1028	msiexec.exe	81
PID 1028 wrote to memory of 3424	1028	msiexec.exe	85
PID 1028 wrote to memory of 4036	1028	msiexec.exe	87
PID 1028 wrote to memory of 1404	1028	msiexec.exe	89
PID 1028 wrote to memory of 3700	1028	msiexec.exe	90
PID 1028 wrote to memory of 2968	1028	msiexec.exe	91
PID 1864 wrote to memory of 3176	1864	stAgentUI.exe	96
PID 3176 wrote to memory of 3260	3176	msedgewebview2.exe	97
PID 3176 wrote to memory of 4820	3176	msedgewebview2.exe	98
PID 3176 wrote to memory of 4820	3176	msedgewebview2.exe	98
PID 3176 wrote to memory of 4820	3176	msedgewebview2.exe	98
PID 3176 wrote to memory of 1236	3176	msedgewebview2.exe	99
PID 3176 wrote to memory of 324	3176	msedgewebview2.exe	100
PID 3176 wrote to memory of 324	3176	msedgewebview2.exe	100
PID 3176 wrote to memory of 1360	3176	msedgewebview2.exe	101
PID 3176 wrote to memory of 1360	3176	msedgewebview2.exe	101
PID 3176 wrote to memory of 1360	3176	msedgewebview2.exe	101
PID 3176 wrote to memory of 908	3176	msedgewebview2.exe	106
PID 3176 wrote to memory of 908	3176	msedgewebview2.exe	106
PID 3176 wrote to memory of 2876	3176	msedgewebview2.exe	107
PID 3176 wrote to memory of 2876	3176	msedgewebview2.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CCD8AF389ADD56BEAE49A1B3F4455920 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2992
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 95BE1977408C00486F561097A749255F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4036
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CDEAB66D5ACE86817BBB7FE25ABB0545
  2⤵
  - Loads dropped DLL
  PID:1404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 61433361B5FA0F7D646EDFBD85EC3784 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 73667F1E6B70D78FE04AE3F8084066D1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5024

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=1864.4772.17854607994106150465
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffde083b078,0x7ffde083b084,0x7ffde083b090
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:2
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2004,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2280,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
    3⤵
    PID:324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2184,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=136.0.4.2612 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4492,i,11819516480780890518,14831182315797343563,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:2876

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:1652

C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys
"C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys"
1⤵
- Executes dropped EXE
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.6MB
SHA256 da17d518a5f596779ed1a9278b550b7f81402365ced021539dc74a50adac1dc1
MD5 db3cae6d9b99f34812855df12074edb2
SHA1 3c83992ebd7ca87f819fbd7701e4d03584a6a53f
SHA512 2daefaa60b87d8f01899f2d09a30fb4cd741435622e51d13e6aca31e3ebd2f292087d73c5d1d6e247614ec8aa023a2bb27b0fba41102a24636a0ae539259096c
SSDEEP 24576:R+uojr0cIAigVc5xIJaWExsIkiKRyfSqG8d6+BctEmpG7urKpsPVa:sfr5IVgVqIY9xD+ASqGK6+2tkPpQE
TLSH
T10D755B57B6B540A8D1A6C038C5276707EAB1348A0B709BEF15E08B6A7F13BF19D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 37KB
SHA256 23cac889e9d53c56443bd5dc763fc35d02f94aceabcf642bde93d8034645cfd6
MD5 3950f9868ff53c231ee80a28a2e74284
SHA1 73a15b1e88bf7e898b6ee8af540ccf094ff173e3
SHA512 f81992ee3c36fdf861ddb03dd0b160d188211a2a6db2112ff51046afd4d49cf547d818f6bb5b420803c5ad1126a2219363b9b5b6bb3da0c7ce64f49ade40031e
SSDEEP 768:swJTwYB4E5n/xe5ar8ur2R1FQoKzCKZik5m:3JYE55e5mZM1fvr
TLSH
T1FA031B0286BD9322DA999E34FDD0BD516BFCF7C379E9D70F400AD1E608963819A90D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api
Size 167KB
SHA256 4ac9c8c815280eaafb760bf1ab044243409eeaa01a22b357f41bcca0ff0c015b
MD5 a53da28b1173f7f4c3bbf0fa42194ee8
SHA1 f69c62e026069e500c6b5b80ef246974cc39ef7a
SHA512 250b3872d29bcd791ae2c8fb60e4bd42ab59eb9000be914201c6c6895374c9cb37f32803d6be439af25d8fd9210444e5bb5cf2b1b362c0d229ac3488993f139d
SSDEEP 3072:aBfVAzUwhB02O+aXEjEBRYCvqrK4c4d/av:aB2sXEjSYCirK4cK/
TLSH
T1BCF3E74BF76900B6D1BBC038CA979A17F9B138918775A3CF87414B661B137E0AA3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat32.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api
Size 87KB
SHA256 fb1c0bdc7ec93420d16d71e80ad1e7c10bcb9dfa7e28a4d1a0528ee3e9e15bee
MD5 c2666927f7ebd66037b491f90e8d7b8b
SHA1 82cf42452bd06a87b4265a1b57a94c543673764b
SHA512 bef96faacf80bfaaa2b928c4ef1ac3f3b92eb022364f22881e9bc9e3359e31845630cdfc60f89954f72351e7f0535d872248d36e56ada8b905d5c842f36dea8b
SSDEEP 1536:Cn4oHk6GYX7kgcAXdp0oLXr08olTYK8pHyXYvvE2vQfM1Pv:Cn4ok6GYX7oAEoLXg8wYKQHmYU2Yfiv
TLSH
T1C7933A31B648C036F99709B6A97D959E9628B9220BD514CBB38C1F0F4DB52D27F30927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobatBroker.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker.exe
Size 156KB
SHA256 ca37b5dd198f71660accd9a8393141d49719c6153df004377c5ffba23b4394e3
MD5 576933569c83e0267f5fc71dac8bedc3
SHA1 90a292dd1eb01c010bdff3bd0a90934e7116b27d
SHA512 a08a86522121271a2c515322685124ac484f3ab59372c8bdb62a2af4b23e4002759426170a77dd923a59331b6c94a25cfe822a81f80e1fb69aaa6d24293d9058
SSDEEP 1536:O7mWQ/RDDr9yD4ykjrMEoTuvw+k663yvXky42/IIchBK8BiCIYC8Hx/pxrGEvqJv:JHZL93rRkuIIwBqYCOVoN9r7cKOvH
TLSH
T1DCF3E54BBB2940E1D1BFC039C6829A1BFEB234E583A5A7CF5B510A671B127E06D3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobatBroker32.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker32.exe
Size 129KB
SHA256 e16acdf55971c4e1a866039ac2aff2392c55404bce137cb5609c5dfc28b8ac49
MD5 5c9adb1040f95d2799d45cfa396bfcbf
SHA1 5ea86b8d10ae100d0e3052e0e8461771c9791aba
SHA512 514b45809cb2394f7fd0d175c7e902d898c293a9f288cf0489eb826f897f3bf311bfbbebeb5f1c49b7eb3923df9a7c3b2a62013fe510a944f0f9ca173129ab17
SSDEEP 3072:QekPy+PqHNbNJ/xk0B5yUYIBd91Klg4EU3aKgzBBUNwFBgpMv:Qc/txk0B5yUYIBdClWKpwFBg
TLSH
T1E1D33A307982C436FAE340B7DCFEADAD416CF9200F5514E7B3484E9E9E55AD2393219A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 33KB
SHA256 a3bd541c53c3054fdaf91e6b4e5c07a334fac9fe9bef0850c9db462c320bec71
MD5 f261f6b09925b326a417de6d4993d1bb
SHA1 9b6045f9de407b771b1271f69ee40ab229c8319a
SHA512 74b02e84e6fc93f279ed9dbe30164b1c8b9cb01739b1ad9c3fcf412d866225eb9ce9131a9ecdc61ca81ed4f4b0b2f741af43ac075173d131c6aa0a3738a939df
SSDEEP 384:xP9CzFCCA5iirDlmL/3blTAY9I0VGWUhtciqh9OCXS/uo6ki2Ki1uxplKzCKjd3j:3CpCxii1mjLmpt2xbr2R1olKzCKZik2
TLSH
T1C9E26B576BBC4113EFCA4F79A8F2BA120978FAC569E2D60F8016D1AA1D033C45B50F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 34556eb70282e9fbf15093d0e95c44dc5a5f18127201a693d9059824fee1eb11
MD5 24607654f904c31b75f29217e4fe93f5
SHA1 8b198509f93ec06b270ba1f3f0ea34986f737201
SHA512 406a943ff2724234c62c224b48c6531d854b36f99c3c05f5f9f470aba4277c29db8c911f0f8280c38c6a0c03f8256f90ed6872586af8bc83b6b8b46a269c80f1
SSDEEP 384:9yw5tUebz1qErhM5Q92rbYQujSQxrRjf3SkDHznla:8w5tUebz1qErhM5Q92fYQKSQxrRrCObM
TLSH
T1B6528522C4E8EE71971712F27EE558210B9D5323968D108AF89C6D8FCF0C9D64B832B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 bde1595e95c15f3f3ac87ac3a86c30d18c2405cee95089ceacb9db23feee0b5c
MD5 204338c7c8a1df383ef04fa3837ead64
SHA1 8d1d2da4da3a8172940e50065bf1ee68e6052c4f
SHA512 024a2aca54a23e6ff398baa4c9dcb3edfbf237973ac20881c891bc056aae7d84db44fba9fc8935757a79c99117ceeaed8acde16ec2fad0bec501b773369f25dd
SSDEEP 96:0WLwO9ZcyBHKDPkTXDQhy8mOWCWaWEZkQ8amTE0CyvbBDA:ffbDQhe/T5hA
TLSH
T143C1A85DC9CCE812E305F9B1BAF28513298937B341ED40CCAE990D4EAF49AD5C6513F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 31KB
SHA256 6bb9c28180f5c0d92f0226058e84f27c0b5c629e0dcd41d68bc26d6e784069db
MD5 551f9b55d8235951ee46cbacc435f90d
SHA1 41cd149831ff09d98bef10a25759e9b9e9947bf5
SHA512 3bc4630f66a338a6f9c0c601022ad8df9b68f8722be94d879ad1daf1fcfa660a0da6c88d10a4b0825c721732eaeffeaa8733d24133bc0f01c3d923fe3e3edfb2
SSDEEP 384:D5Vb2YAc/LlrdOrzK4CZnWJfpqFsaCtywJfp16fTSyj1XFRWKuoZg2vR/uo6ki26:tAYAoE2eQSlrsa0Ir2R12WZKzCKZikL
TLSH
T1F0E26D83E7684213DF8F5BB86CE596111DB8E6856EE7DC0F6009615E28273C03B68F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 6556a02e22b95ad955253953dab664dcd12e5e54454d89c705a8f1921eef41ec
MD5 5bce02b7a3a6d395c8e69b7196a0fee1
SHA1 3c00db2ebabf692b3e1c4b88c25ffefa59938fd6
SHA512 0161ad0cd8442924f7c81d0231169046293001556c8d075ca11bd65caf26ea849dfdfbd8c4148073d501f1d94030be108ceea731a45b76ead0f16725200ad7a1
SSDEEP 384:Xyw5tUebz1qErM5Q92rbYQujSQxrjfiukQ7TPf:Cw5tUebz1qErM5Q92fYQKSQxrrjtTPf
TLSH
T16352A522C4E4EE71971712E17DE658210BDE4723A5DD0046F8AD6E8ECF0C9964A873B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 9641168b1dfb5b55e9971fc228b4882cb219e1c89b8e22a304ef87480c48f1e8
MD5 3d073712a4ec621b5ea360a816762786
SHA1 e4a140902cdd9519df1fd3ab21c6aeb68766e66d
SHA512 e8b9e2e98fdfbfdfd1246378e9bbb7bbf10206e930e84606bcb61c8916bea672be742661adce5c17de6721f7dbc220af8a9a84ba2c4b85c0a44b4c05a58dfb01
SSDEEP 96:0WLwO9ZcK5HKoPkydQ3mmOk+aWEM/9mzEx9GlZqbBDA:fsygz6cPAA
TLSH
T100C1976DC9D8EC01F300E5B07AF2D51319861BB350EC0199AEAA4E6F9F44DD4D5123BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 31KB
SHA256 cb1b647928ddad11a3b5ba66c8567fd3ce1f783da139fe6637890fdadcb5e666
MD5 7d228cc7f2606ef5b3f1aa957eae5170
SHA1 c700fb525f900bbaaa263829a3f11aa312e503b2
SHA512 db70645bd03f77e0c2436d76da758168b5fe83011c8ce5b2125ee213c6c5cb56478be2af7c04faf68b5fb95709fea6543e040017208f554817e8a33f186c597e
SSDEEP 768:S6T8G2rYiH1WpHiU9n9rr2R11doKzCKZik:5D/iUbfM1wv
TLSH
T18CE27D8797BC4323DB9A9B79B8F0B5010EB8FA865DE3E90F5016E15D1D067902B50F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 e51b7ab7ef3abdb7fb7094be0ea6637de42c65bee975ae75763ae602a5cda95e
MD5 0938c26ba644631a0a6beef6ff755fff
SHA1 2f754de6acb27166137d9f19434ffe866a396413
SHA512 0a1ee6c490c72ac883dd7234f62e9560729472a01db78f728cc69675018eb068fc730f0d40d5ab24691ce6f54ac454f3df8cab7f2843bf42ef9d566a6b559172
SSDEEP 384:dyw5tUebz1qErMm5Q92rbYQujSQxrjfFik+R4v1E7i:cw5tUebz1qErMm5Q92fYQKSQxrrgbREZ
TLSH
T1A252B522C4E8EE71971712F27DE598210B9E1733968D104AF96D6D8ECF0C9C64B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto
Size 5KB
SHA256 e4cb19e6310731eaffd3bfac9bbe129d2322ca41eb54ff28f041b0ec7a5f5569
MD5 d393ef1edabbe9441e6c54f8ecaf0e41
SHA1 31e16530f5cd1aed6162cce90c38c8d3661f6c16
SHA512 b452cb151d535043fb61f822e5a70f4383b61c9e35d1e6e90fbbd7126a08098d4f30792d45ea6a7f3321eca4491dd5805bdfab95f5e7fe3e4797b0758fd8984d
SSDEEP 96:0WLwO9Zcz4HKZPkdDuo55mOkXaWE2B80S8P55sm11Ef5h3bBDA:fvZdchP111A75A
TLSH
T18FC1A59DC4D8E842E300F5B1BEF2D5423A852BB345EC408DAE6A5D5EDB08AD8C5512EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.2MB
SHA256 decb0ca189bdb69d90cdcebf6220dd570a648e4263eb85cff26dc080f032d977
MD5 da58f790a2d2e067e65a541bfdff494b
SHA1 75cd3c4eece908406c31b3b4b6d6e2e0d975d527
SHA512 e84a9d1ab3ef184fc702570b58a7d72012dd3cb7ca102ab7aaf981bae6ab47420c57b7ad8e327b4da2d2054cde05199013c03ae314118eff81ac18d49e38d8fa
SSDEEP 393216:fL8DrXSf25+gNdGxtfPEumKdkUkfDB3TS0j:fL8qNkTTj
TLSH
T157F68D6AA6A800D8D0BAC0BCCA5B5713F772BC45037567DF17A096A61F37AE45E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 212KB
SHA256 1a0b09d2fee190bdbf38baf742fc4c3b817d9b575877dd99af0038805df403ea
MD5 a8c959968f4daece099500f24f579e1e
SHA1 91fb347b757763a69955dd992131fbb7c8e5b808
SHA512 17e5d51d32e95d4ea6d51df050ce3d4eb4b8bcc52809039f3b7e622e2523c31fa2bc2c3aa1727fa676d8fef021b6eaa5ee879c6ef1afd78726ef13e735586449
SSDEEP 3072:gz/i7CFs8MymnqRq9fnkIv0WV/aBgPMrWZ1g2PuZvoD/vq:K/i7C+9PkSygH8gD
TLSH
T1F224398772A800B9D8A7C23486835E01F772F84587609FEF03958A7DAF5B7E09E79714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 170KB
SHA256 2b610fc098c8ef60f4b7525fbb2d22b04091688cc7f0e37e31537edd178bebff
MD5 bf2bad1c2177ce4cb8ea7f67d4185c06
SHA1 0fa831f00159742274f30a328a869684aae5350e
SHA512 f37cfad8959e2d769586d1cc8ef557b04c5bf9fb0febce2c287cb40bceb21675ef79624aeedea9c683e03e41073f5c7a709fecdff27476633d7a27fb69debb5a
SSDEEP 3072:bHxIuqH3SHkHyORtnPr5D6b+57vk9pariBjdIecDvdoTp:bHCuqX3zPFD3SOecIp
TLSH
T13F044B0276919071D9AF06B85574AFB3DB7F6A60CBF159D733C40AAA4F203C4AE34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 81KB
SHA256 2c8a02855c14936eef2f82d7bb8d8c35350fe923c5758b00903a0f0f8d259eda
MD5 88b698269fc1761bf5971521d75e9048
SHA1 20f2ad5f42370ba115774508df4145c7a74fcec5
SHA512 90bf0adf825876bd3fdd4be07219a350b4b7d17bddc5494d6ec4255d749ff0a416fbd9cd96fef7b968db2bc67b7921bc60c474192da9415fdf5a3b06ac5e4812
SSDEEP 1536:oGT7rg4dKKVidHmQcJxfHDj333XuqcM19cvsRzH:o+jKKVocJxPncUcvMr
TLSH
T13C8306F2226C44A5CE968634C1A7DD22FBB1FDCC172147DF02C6899C7E62BD05EA961C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 69KB
SHA256 783cf1c27898c820d7f398679c15432914b57b0e98451fd5d799bb713d7f775b
MD5 cfb7f4d033ac66e6a321bbadc8711ea5
SHA1 7ce42f6dac52500ca5f1e46c6678d2c12cfaa975
SHA512 47398d01a3c2d62842b909e3033cefc8c9a3b526f10d51c6eb708c3c1a68fe8daf9e590c8f39428fb12e34f22b9993a1bfed70fcfdfc2daf0a712906c0171080
SSDEEP 1536:aGJNmwl5UCVTaA3NVJFp5kWM15ovJkxz2:FJNmwlCA3N3Ffxfvc6
TLSH
T175631ACE990003B2D9DDA9FBB3AB6737356F675007F610D7A14949A5080D3EABE2C706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlp.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll
Size 831KB
SHA256 ebeacd8cf7ef1f6ba75d6aa567e09a4b75bc6eee8c0e4efbd038a414943bda52
MD5 eee50c259b504c03cd3139074badd35e
SHA1 851dcfe04b05aa5a24cfb8bc45fffe1b833ad0c3
SHA512 7d2e102377fcb7592f6870624848d4d7a79ac26dc47dbc6a903f2b0b5491cf16019596d805062e5f66c6c43e806d9ee81561a7fd3219fb5047070734128a1056
SSDEEP 12288:KFVM0P6RMOs61H9eVtesWGHXUuMJeVCFtL5oH4:Kjh6RNVcVtJMJ9tD
TLSH
T152055B3B626C52B8E0B791B896DB1951F779BC1723A055CF43A049793FA7FB41A3A300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll
Size 681KB
SHA256 c47481db88235c2a246e80c8d21b98bf6a115016a74420cea4029bfa5f4243d3
MD5 66863ad2a8bde27b0fcb53ec929fd5b7
SHA1 54af22b663a5506458358cc51407d29a29f71380
SHA512 d9990633534fd8de96a518e4cf624dd7fda28a0afbe345319f5dcafb737dfb8530c2b90f1e087306e962c1c9e2897c6dfa44d26ef7d963354d999073a15c08d6
SSDEEP 12288:CEPJ9ItaUidExQfuh1W3kC0He29MHxraAQ40uGhe8fiGMzw76l:CUJ9FUid4h1W3kC0He2OIFe8fZMzdl
TLSH
T16EE47C3272A181B1E4AF56F52525EF3662FC29362B7115DB87E05E7A4A30DC0A73DF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.2MB
SHA256 34edd2d2aedd9dbfaa21c661bbdfc261167786c80fb62f8d01c44a9262bc4793
MD5 48849edd744f98b1d1f949c83106626f
SHA1 898f2433155c768e9dd031534605f65243f74a7d
SHA512 78aab6e12b6d432ffa6da68709ae0f291e1fada3e4278656968df91484420037dc64737b8b3637e8e757d26a14c53a6ed4c30df68443037a720e0ae67e764504
SSDEEP 12288:5E5ZjzwAqG1MbGEecvZuGMJIa6l5l8QG8mcigIgqbGtphBMmOayJH4OTcculD:5WRzgHV5BCJIF7abGtphB/OBH4OMlD
TLSH
T14545EA21232B2F73D65637B5FBD31EA1A3346C4773597302A1DBA0211AE624CB2E79D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.2MB
SHA256 fa14ad69db4a02300b5039f35c95b1463f7fe3e22b3e7572b8d16f7a8c2790f2
MD5 24bcf2bb99f36bc6bdf6a3cf34dd61fc
SHA1 bc90435bb4cc5737393c5d6adb353f32063a303c
SHA512 de4df284c38d2623b40497cefbc9845cb3eeed872856f07bd0c08e09d51c9298cd5fdaff07fad769c5e353c5c94e240141e14fec11708345be76a59f425c34ed
SSDEEP 49152:dGtlqXDaVwASO3vgB85RS6sxGFLgVxJ4uMXp18Es4vWKZ3Luv5z1MlQkSbqOd932:jK7mtGG4uKZ3LuDF3Zle2+c
TLSH
T1D7469E69A57C00D5D8BAC1B9C2865227E772B45543F05BCF1AA086FA1F63AD01FBF780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 3KB
SHA256 e79d4ba3ae6037f9aca03d3c9474ebd5891bcc1dc1257b5ead90e325035293b8
MD5 f79721c6eb2d882b9c778e16296b8149
SHA1 deb536573ffe839aa2234238c7240987b924df55
SHA512 719a298563ffd47f3a64b480d5d15c20bf23b9aaf325dcca1b99e389d36131db3c9eac081f5d75b722292a6b4379f9f9843daffbcc657cf5b782da285d08cca7
TLSH
T10661EE58A7A24A78E98B33607F133883B7657080E0F8244177EC9189D3D2D5EC5B1BFA
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 227KB
SHA256 f7b9563aee0a82fe39f43128278cc1d9b6562750a16e2c809b84dae7b99bf3c9
MD5 21a281e615ea3207b65bde94d255908c
SHA1 c18141ce0ac2bfc7b87637e7d0addbc87da8bed8
SHA512 f1c3fb8876984d61ccb4e2f73d0cabddcb958a10e782d516e03e0ffe1361b510f5c25ff83d466a1cf7befc991204c50b191be43872f0e856b739b878d8494066
SSDEEP 6144:imLvR1RrqfhWjigSwfI0uFpaq/6P7PLYMA:i6vRwcSwo6jLm
TLSH
T15A349D16A39509F4EAA78274D9B2C513DAF2B8051332D6DF025486A81F37FD0F97EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 75KB
SHA256 b3ebccf4768399ec791a6119a9d97caff4bd35e89215fa5b2faa644d28e52d23
MD5 15700bb43c63dac566449b639c0ab13c
SHA1 7b79067f03a329f2f47efb986ff43d4cafa1de92
SHA512 fa16f662b6eccd83604eecd8333583660a3ed64ea77365e3769abb485e3b0b4944db5a866e53de6bbb442944855f87198e0a1b9ed47e0e07b69ce8320721f1c5
SSDEEP 1536:jcF/xGsJF2HweEuAnKaccVPFHZL1DdYtSkM1hv1hlQzk:IJzJVeEuAnKaccVPFHZL1DqtxIv1gI
TLSH
T1EF73F65112A5C4AECA21563480A79F13FA73F7092763C7DF0A96788C4DAF7EC5D38628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 66KB
SHA256 5a3e8651e7ad17a22ebcf74471397aa546e0593fbba2b79d2afd8f6c94bb9615
MD5 2fb8251049ff2bf1cf3ecbaa648882a1
SHA1 6793114d7af936b96b13d1622f188422d592a164
SHA512 2dab631152ee1001d419366d6cc1627bf4fc71b5eb5cdfd98e38f3f16668bb077f418e3b22f4993280e623abb960fc050e67f67e1344af22044662deb8d25ee9
SSDEEP 1536:iand8LOaty0g3Kq8slpFHZL1VhklM1lgvy5zB:iandgty0g3Kq8slpFHZL1VhSEgvS1
TLSH
T127631A426E5C02B3E9AF7570B2A926261C795B0757F650F3F5600988FC393E97A3B702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 9KB
SHA256 bebc9d11a652b91f8b513f44524da3f73d05042ab4cc0901202ba0e57a5d3fcc
MD5 4080b9eb2906f9e4b0c5fc4dfda22e0b
SHA1 65e5479004b70f9f48deb8e84088b1d32e3b89dd
SHA512 612d799e6264370f03add7a974eacd27b0d0392c37f0c2134bf3ec4e43949f3b4c11c5969cc557ed9eec98ca943e0f93a325beabe6367a6142b53b316e437dc6
SSDEEP 192:2BTlxU5cgvqnGZBu9+VsYQlDRIGQ946lgl7l2lblulFSTMbUTMRMdYq0t88gYaV3:tGxkRswBa3q
TLSH
T1FF128CAFFBE991317ED0035020263B268CE86F6875B218DCFF615E0676CB65741CE869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 19KB
SHA256 a2e47edb24fb7272bd80b92d24668dc74b4a5f3017e55288b55c3522001743ba
MD5 d7415af43aecfc2563706462c7323461
SHA1 b8488f5db9146c15bc568c821585bea9d665d8fe
SHA512 47911e697f509ac8855adb3fea11adbc4839599e7ad259b6652c10c74a1be6b21065eb63bfe0cafa85072560c5ee0caa78725690f779a2808e11ecfe173fcead
SSDEEP 192:2BTlxU5cgvqnGZBu9+VsYQlDRIGQ946lgl7l2lblulFSTMbUTMRMdYq0t88gYaVY:tGxkRswBa31kUAa
TLSH
T1D9929DCEBBEAC2717FD0139116162F558DD42E0C367228DABF512F4A73CAA5630CD865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 1KB
SHA256 1053a6f97ddf0917eeb9d0a4c2ee822dcad7bd642a35cb2fd2db21d0fd265678
MD5 f0796348603b3ab286155dcbaeebc844
SHA1 c508d42af7d4566a82e4b12fa89f5e57bd41c663
SHA512 be455972628559a692da3cdc25c27b3d5223da6a638672e44fe946840a606701e413cf2525b957d3a308ba969a048dfffc4766d95a945efed82cebef8b5edfbd
TLSH
T11B31B85D46A935D17BCB9C7C99CD4F3932A4D0F1416C9046B43B4776A4A03335FE6426
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 c9f123dea018f01341b9ebd9c11aa81bc399e0299742dcf049dfa59f8d1df402
MD5 9dbd8bdbd8db0266a5d30d0e184fcceb
SHA1 081fb9b8d4a9fee458f517e5ca0c135a0ca08515
SHA512 879c99b1cb6b264e9eefd84f35128f683f5caa7bee69bf40699fae78c401fa4e66ad54b14580b09d6808e663e4162e9ff93454fce6e00837f48a19ce28f4836e
TLSH
T1E431B84B862819124A24DCF166E8CB333DF1E2A05DDB342426BA925FA5483F33F549CD
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 5c29bd404a53113062f9e0a60a68bd3dc7de1f7af36e0096ca0300673eaa2f19
MD5 ae046b1174b85205f0dcfd9b6fd96789
SHA1 fbf8d1dac958d7a1249c5db0ed4c10aaa18c3830
SHA512 f67019015daf979e414dfafbb0268ae9208f9d02440e97e9bce167d753701c5ddca6df4f21e7db4440b07c770c2ac1c0cd2a4999ba6e5dcf6100af7c86820e84
TLSH
T1632194070EBA18525F25EC8D08DDDA237C71B282C6DD3207B00B067E0C827B66F4D45C
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 540B
SHA256 0de9da15ab7ac9be2f6c437215f184bbdad6759727903a9c08d87f9c7b55478a
MD5 dea91694f799c69cd176a2581206df6e
SHA1 fffbd38d8846f7cafedc85f2ecbf3bb15dde933e
SHA512 ade4de4c15454a3758e49003ee75d37ddae78dd67cf447acd5894bdc33bf9bfe31ddc3f2681ea26e214bc06d65fe48a7e1bd11baf586b5165b281a15af3d9ff5
TLSH
T129F09E2410FA400FF077F97847D1A592EC65F92124215619156D4348BE56E415C83B3A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 d1c88129c411cc5d6e36154feee2e965372082cb930f363b7fb189e0405aca8a
MD5 7df17b0023adec944eb969e0e26b1829
SHA1 d4272eb8531bd90e5f50b3ca853ce8e92d31ce12
SHA512 be05ecfe44d2c996668ab5995d4e9c4644319f5423d096f276a6d8f5de44b0982c65532812b00aa040b9ff0aba5b0841ab0afc6fede27bef0e9c68d4a37e90db
TLSH
T1BAF0DC1404F8411EF033DE3949FCA056EA35F8222C626A6513224F1E2C27F41CD2643D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 35ac7b1cb3e2641603fa4c147ccb75e01979ffd5793ecfd77c1a31dddb56c954
MD5 f67c11c143eb78c542bcdc29efb06d8e
SHA1 49fde2a52f689a850cf9f85b1723d70fe1df036a
SHA512 4d0c85413ff2d782527f6e250f47208649f16b6dd9678689fb1df86f1c4855fe3c49b1a36778e5f317c66fe56a7930442b2534b656babc73be8ad110d1cec699
TLSH
T177F05C1869F9900DF273EF7495CA62F7A92BBA03286506BA142943095E22F112C0263D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5CB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5CB1.tmp
Size 5.4MB
SHA256 bcf053b823d3832bce8de50d02aa442e191c19b6de9a1cc2e3ed62844bce6b00
MD5 bba39beaf92976fbe6e18322ec4bca7d
SHA1 15cb481795fd25ba1c86b7953f5c41c03ac91858
SHA512 602d6e2c4d9a9159f7bfa8c3f0d5738ff530a35f49aac1ef283b5d8d4ca22228c08d33fd1bc7b1ab0a9602d5731ed960687e36f9190655b1727cea339873db29
SSDEEP 98304:NRS/Mp00A6vXYiPCsN0hCSVj4tP+HxasP/kLxy7gG:NEM20A/sNNP+RasXkly7h
TLSH
T19846AE22BB41C072D49D02B1217EAB7A893D5834877445C7BBD12E7998211E37F3BF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 641c30c249491336452ce0fc16c82665dfd4ff537d1aa324be2c66ee934f55e3
MD5 cc0157d297c137ed6198c78bcbbad679
SHA1 b25b18052cca43e2b9cbf25da70b2a413a807c21
SHA512 226b7688713c921adc5890c62ba7c5b752d55dab42895d0075b83696f01223c7b4a5f2e1c2817c787cde1801b6b6e5d8ac1ba02e965497d908de5d7d56d96251
TLSH
T189D0245337110734C41030330343750D1443C51F4005C0C5543CD7DD1F144500D13CD7
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 67513455519cb3cebf700afe4b1029e6f65021a3ca58bf858ed04484072f2937
MD5 8235f8ccf3f0ea2a05e8c0c05e317a78
SHA1 ac23886e4d61b5d3e282e44e8149ace5241c2e20
SHA512 aae047772199df5933b5490b3e7d34064b914df586e51c8620fe1c1bec90e52e2328a0f238a84dcebed8c670a4754b6001e1c88a6fc656f7f5df948ffa5f26c9
SSDEEP 3:LstlNllkll/lgoLKX:LsX3lEtgo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences
Size 6KB
SHA256 756dd5904e51e4f0b94395078307309445e4fea87c47929a55bf14a4d78215b3
MD5 1e418a01dd9f1f6546a0453e05e3f4f7
SHA1 57f849e415dd76121b9af1c748b5abc15e578a6b
SHA512 7c1e07f38f8164f50815ce82fd8923ad675df9f57df0b03c5b2b5cce268be4d18a2e3361a8d80852b122cddd565fc582531f9734916d3101246af7ca3e98b543
SSDEEP 96:stu05U+N3b9iffeZ8i0v2zEJklm/7qx+WVHMSm+uecadQjH+gGgMOYL:stu06Pf2Z8plX/S+Wi8dGcgM3
TLSH
T18AD197525F68697B4CC7E609BA25BF43E6FA606265D50D58EBFC870C04EA6CC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59619e.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences~RFe59619e.TMP
Size 6KB
SHA256 6a7d86c2d702573c3fd4631314e7b04aa15fe27aaea8c696ff7d90cd44bc3a20
MD5 dd62dbddc284d318f87b72befe392752
SHA1 0ee348f1d353ac66416bcc6c084e1eb9c7d497da
SHA512 5afe6b76a7c04ea7e1346783a34ef8932b53e4ba012016c0b759aec8e8cd625700821e064e2489d482d5422d2f669a2c7391b93f567460b056ec89f65cd4d791
SSDEEP 96:stu05U+N3b9HffeZ8i062zEJklm/7qx+WVHMSm+uecadQjH+gpgMEYL:stu06yf2Z8pcX/S+Wi8dG/gMF
TLSH
T118D1A8435F68697B4CC7E21DBA35BB43D6FA206266D54D58EBFC860C08EA5CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 1KB
SHA256 096948faab564301ef7e164b80b7ec0fc019981b6417c21c2a484252133eb260
MD5 370b58cabedbf6d5993121341ff15163
SHA1 70c77550f7e340feabc435851c916dad16eeb3b1
SHA512 9b56b3e737600bc975f4bb11bebb7cb108f7243abe068f8ceff17ae931a1efb6d845d15585a774fab6513dda9064bae781ee047b4394ac631aff9a56ec10a7a0
TLSH
T1D531A773D0946B776D828545B246BF831E7150258252CE0C65EE4B0C01EB68CB137D36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 2KB
SHA256 ff015d3c7d1d4e8afe09bb60110e4974863e14c64e5b545fef0d763345df3d99
MD5 0c2aca9b8ddb169e4670d55ce834de3a
SHA1 459a6425e3a2c71ad524c72e14d3d3274c00ca4a
SHA512 8465fa3e363207f2452e66b3cdb07740a257ba0553d21445e8270f54232a2a6a0641d2283ca87f3f49ea4473e1bbbefbabc429392ebb071a9a5e4e67a4791750
TLSH
T1C951B773A414AB7B89E38A44B94A7F135E7651618BA2AF5499ED0B0C01DB65C3312C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 d8c620d02d7daa9b4b430783b0118a95c3a26998792e4197ad87eb8a703875fa
MD5 2d9cc7a3f8d02ae2c29aeeaaa64f2e24
SHA1 243aa15d8f98e320934ac9d2bb17fa57de9fc8fd
SHA512 47ab808667eff8d58eb6edbfa27722bfdc7e29c24dcf0444a3573dd3d7d6c92095a477d351ebac32a74d9310e2ac1a7f1dbed631d6ea234f5b85fd8419a6ffdd
TLSH
T1D67185336464EA7B4DF2C904B9862B137BA65122D6D27F98D9ED0F0C01DB3982312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 15KB
SHA256 267680f9be1197e89b17485ba260efbd092408c3ca4a18750fa2872da6d44ad7
MD5 db378a9be7ee21f95e798c5c2bf9b470
SHA1 081d8e3dedc7888fdb907eacc4cfd1a114c02964
SHA512 26ee25e3c7c930c17fe28f5367832fb0708e0b570e06a5c4047067f1f3424c347629740ec6352ff92d605b8de1d228997d5305112417971bb5a27a303c7beb13
SSDEEP 384:zAfRE5BdEZfr0kuh9Rt/nP9yxNbAb1bqN5ducQ9:wRkurqhNsmGN5VQ9
TLSH
T14772AE7349319D3B6CE7C50A380A6B0759B8848996E26A987CDD5F0D0BC7BD51323D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c35b.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State~RFe58c35b.TMP
Size 1KB
SHA256 082bc31f2c628502a455b7e67928454f049692bafc29b0214547a1f0950e71c3
MD5 4ecbdffab197698af8f776655861ec4a
SHA1 e25e1615ba348cfe81e2f7af25c04779d3452660
SHA512 eeef840dd91032ca6e4173a2c8bd5f95fa29fa27c494de7469b3df019952e4db5f45015ae91d4ef330b7c1888a875e5f7c8975aafae56503f0a6035f2468074c
TLSH
T19E218473C0D4ABB7AD818945F242FF872E6055754252CE0CA4EE470C02EB688A233C37
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 782B
SHA256 a38efe1bb2ad05234eaa8b2967aab3f136d7bd66e1afdf4f7a64a4e5ac22b63b
MD5 6eb416cdc02e68e6fa5d548671be6912
SHA1 962cb2d2f0b1d110880d73727f2186a7cd2a6a70
SHA512 797afa06501b72b3033b0808ec80b02dbdb39c41b00207997ac0357c583fc646b67240c4d678e6153a637ea2ad27429899501960f597d621e985a977776012b4
TLSH
T1C0014907067D8FFB80191CA0DB8E68299F028E5D31DE58A7F9BE210D2F09144756E0A5
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 9KB
SHA256 f042706b77a8a806fbdf587351d9f96d6153e0281c8d519019ddf60975bb51aa
MD5 5a703ac33e4d16b11062c9ce57e1fe7c
SHA1 9105c69497aeb4e4f61b71c16de9cb572711570b
SHA512 f2a117433dbfa4b82c9c12eadef0a15eda8b2d8d88c3f99a68b10aca40ce7891a78287954849c85875a14aff12cc33869f81cd596b293d58beefc6633d1e9b4a
SSDEEP 96:VbKGAGToQ3+Bm3NuZ8Ps8ZB4dlRR1ZN39D86XnhOPCR86W/QnJxnJD:fcZm9uZ8Ps8ZB4d7FpYPCVW/QJxJD
TLSH
T17C22EF0B14785EFBD05A0CB4E68D582D9F03CE5D319DA8D2FEBD52447F48281B25E4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 1KB
SHA256 cfcb0557ce6bdb76baa36c84b537407b9d4cdfca1bbc45a89d1143b2984c8ab0
MD5 f1e8b9a7b8b6c2457518b4f8541a9286
SHA1 42d6b5585917f405b48c395ee16c57924846a142
SHA512 86cee5c6fe1ef4b52339e82d39b81da55faa77912b6b57950c6c0a620c7b0de1dcbe20732fe53b80c236a3fdb052d7dce053104ed38c132ada7b9787b43cdff9
TLSH
T129315829879314FD3B833F8EC39B9C2CB5527D59934D07E2A6CF41026748290B41F857
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 02f558f8a5bced0c95d015cfc6ae183f73669126dd064d7097deca91ccccb1b9
MD5 b198a67bf6c3cdc9364e474aa8476b68
SHA1 11541f2a86155f5bb22c5986c980d122f44092af
SHA512 07ce903b8ee96f91281fdc0f7f938372658ac230ef472abfa906080090589a7b02753b1ba9c8b083f45df833c170b81df49693e835e1b17e9c00fb59f743fb44
TLSH
T1D2819F2A469719FE37533A4AC78FAC2C6E017D5C578E06E6B6DF53067708294704F8A2
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 12KB
SHA256 408d7be61eafa57ad917b74d979d4421c86cb67f68212fab20cdaf4b2baf2b83
MD5 fcebda74366bae47c64a22ff6be33148
SHA1 77be781c182636b1847feecb4fa3e4b7c582268c
SHA512 1d93fa1f1450663d040c4d6738d935b4e5bd13b2cb1d4c37dbcf65b328765787399cf7e3530e07d2125b8353026d19ea48f9bf7eac71e4d59a1c3fc4f332b64a
SSDEEP 192:Pw8wpYpJufxitx13voiz9s6Z7Su0OdQ4q+LAce1loyxlAZauR4OWuAPK7u16FaJy:PX443hbcx1xGDsP4F0Jy
TLSH
T16642AC5A5AAB1DFE3353394AC78F9C2C9E01BE5C5F9E05A6F2DE53063708158B04D8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAE24.tmp

Path C:\Windows\Installer\MSIAE24.tmp
Size 572KB
SHA256 6078e3065371c790bf3a22a49ce46f1cf4690787c36eb6b25b7d1f1e0e714ac8
MD5 107530f38384e878a4da8128238ecf9c
SHA1 2fe99d938fea3fd26dc12edbb9232f1567393bf7
SHA512 6239166c0dff75e79e2773cef27b06fc0c198d61d50c46e22733c5363af01ed970c793020b57d6480d4f0cdcfe2b17c5aef72447308fdb7ac396469a6aca2183
SSDEEP 12288:fyEECCI6+immO9k3AFkPHph0lhSMXlUpZU+:HECCQ9kwmPJh0lhSMXlqU
TLSH
T1E6C48C16B3E902BCE0ABD27888974A15F77B780503A15ADF03A096632F677D19F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_915341368\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_954698782\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3176_954698782\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-167-0x000001A93D470000-0x000001A93D47C000-memory.dmp

Download

memory/1360-734-0x00007FFDFFD20000-0x00007FFDFFD21000-memory.dmp

Download

memory/1864-1184-0x00000000007F0000-0x0000000000EEE000-memory.dmp

Download

memory/2888-3-0x0000023D6F7C0000-0x0000023D6F7CC000-memory.dmp

Download

memory/2888-2-0x0000023D6F650000-0x0000023D6F76E000-memory.dmp

Download

memory/3176-1090-0x000001B44EEA0000-0x000001B44EFBE000-memory.dmp

Download

memory/3260-1091-0x000002899F820000-0x000002899F93E000-memory.dmp

Download

memory/4820-1092-0x0000020B47400000-0x0000020B4751E000-memory.dmp

Download

memory/4820-629-0x00007FFDFFD20000-0x00007FFDFFD21000-memory.dmp

Download