32c4832b0904cedfdd2d73c65d5e85a8d2f2f4f5e16894168fe2f74bab1e7770

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 35.1MB
Sample260516-gza2faev7r
SHA256 32c4832b0904cedfdd2d73c65d5e85a8d2f2f4f5e16894168fe2f74bab1e7770
MD5 5c5190f5718b966b88877c7d3104282a
SHA1 75b439975887509ed06abb06b383b3bb7ecd965f
SHA512 009c10c5230119eda0c8b6cb40dd584b9eccf058f5380dfe3cf9e06bc6c8305af6b748f08f6e49ade37ed6c0785b2e8e9fdf2b01406baec4a137a75ea2abbb87
SSDEEP 786432:hST9okpbfcL5yAoGsnDEttuQ1eiBuct8dOns:ho2k5cgAoGgottJIiIQUOns
TLSH
T1CC872322BA02C031D59E1171E56A97FA897D6C34C73045DBA7C03E79B9312D23F3AB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5116	stadrv6x64.sys
4432	stAgentUI.exe
5856	stadrv6x64.sys

Loads dropped DLL 19 IoCs

pid	Process
4788	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe
4684	MsiExec.exe
4536	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2776	MsiExec.exe
2776	MsiExec.exe
2776	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2576	msiexec.exe
4	2576	msiexec.exe
7	2576	msiexec.exe
31	2576	msiexec.exe
32	2576	msiexec.exe
37	2576	msiexec.exe
61	2576	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\epdlp_hook_hlpx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-de.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\chromehelper.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfprinterx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx32ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\chromehelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tramp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nstls.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.sys	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat32.api	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfprinter.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp_man.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll.manifest	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-fr.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfium.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinterx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64ipc.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfiumx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_text_extractor.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nspacparser.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\DEM\demAgentSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI700C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI780F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI811B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID701.tmp	msiexec.exe
File created	C:\Windows\Installer\e594a0f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594a0f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52BE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5A84B56-9BCB-4B87-8F01-5E135229AF03}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI703C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7791.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C71.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7108.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI815B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4CB1.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2576	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0dfc9b49-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0dfc9b49-0000-0000-0000-d01200000000}\MaxCapacity = "13092"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237365987336044"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0dfc9b49-0000-0000-0000-d01200000000}	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2868	MsiExec.exe
2868	MsiExec.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3776	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	312	msiexec.exe
Token: SeCreateTokenPrivilege	2576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2576	msiexec.exe
Token: SeLockMemoryPrivilege	2576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2576	msiexec.exe
Token: SeMachineAccountPrivilege	2576	msiexec.exe
Token: SeTcbPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeLoadDriverPrivilege	2576	msiexec.exe
Token: SeSystemProfilePrivilege	2576	msiexec.exe
Token: SeSystemtimePrivilege	2576	msiexec.exe
Token: SeProfSingleProcessPrivilege	2576	msiexec.exe
Token: SeIncBasePriorityPrivilege	2576	msiexec.exe
Token: SeCreatePagefilePrivilege	2576	msiexec.exe
Token: SeCreatePermanentPrivilege	2576	msiexec.exe
Token: SeBackupPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeShutdownPrivilege	2576	msiexec.exe
Token: SeDebugPrivilege	2576	msiexec.exe
Token: SeAuditPrivilege	2576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2576	msiexec.exe
Token: SeChangeNotifyPrivilege	2576	msiexec.exe
Token: SeRemoteShutdownPrivilege	2576	msiexec.exe
Token: SeUndockPrivilege	2576	msiexec.exe
Token: SeSyncAgentPrivilege	2576	msiexec.exe
Token: SeEnableDelegationPrivilege	2576	msiexec.exe
Token: SeManageVolumePrivilege	2576	msiexec.exe
Token: SeImpersonatePrivilege	2576	msiexec.exe
Token: SeCreateGlobalPrivilege	2576	msiexec.exe
Token: SeCreateTokenPrivilege	2576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2576	msiexec.exe
Token: SeLockMemoryPrivilege	2576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2576	msiexec.exe
Token: SeMachineAccountPrivilege	2576	msiexec.exe
Token: SeTcbPrivilege	2576	msiexec.exe
Token: SeSecurityPrivilege	2576	msiexec.exe
Token: SeTakeOwnershipPrivilege	2576	msiexec.exe
Token: SeLoadDriverPrivilege	2576	msiexec.exe
Token: SeSystemProfilePrivilege	2576	msiexec.exe
Token: SeSystemtimePrivilege	2576	msiexec.exe
Token: SeProfSingleProcessPrivilege	2576	msiexec.exe
Token: SeIncBasePriorityPrivilege	2576	msiexec.exe
Token: SeCreatePagefilePrivilege	2576	msiexec.exe
Token: SeCreatePermanentPrivilege	2576	msiexec.exe
Token: SeBackupPrivilege	2576	msiexec.exe
Token: SeRestorePrivilege	2576	msiexec.exe
Token: SeShutdownPrivilege	2576	msiexec.exe
Token: SeDebugPrivilege	2576	msiexec.exe
Token: SeAuditPrivilege	2576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2576	msiexec.exe
Token: SeChangeNotifyPrivilege	2576	msiexec.exe
Token: SeRemoteShutdownPrivilege	2576	msiexec.exe
Token: SeUndockPrivilege	2576	msiexec.exe
Token: SeSyncAgentPrivilege	2576	msiexec.exe
Token: SeEnableDelegationPrivilege	2576	msiexec.exe
Token: SeManageVolumePrivilege	2576	msiexec.exe
Token: SeImpersonatePrivilege	2576	msiexec.exe
Token: SeCreateGlobalPrivilege	2576	msiexec.exe
Token: SeCreateTokenPrivilege	2576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2576	msiexec.exe
Token: SeLockMemoryPrivilege	2576	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2576	msiexec.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
2576	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe
4432	stAgentUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4788	312	msiexec.exe	93
PID 312 wrote to memory of 3484	312	msiexec.exe	99
PID 312 wrote to memory of 4536	312	msiexec.exe	101
PID 312 wrote to memory of 4684	312	msiexec.exe	105
PID 312 wrote to memory of 2868	312	msiexec.exe	106
PID 312 wrote to memory of 2776	312	msiexec.exe	107
PID 4432 wrote to memory of 3776	4432	stAgentUI.exe	112
PID 3776 wrote to memory of 3604	3776	msedgewebview2.exe	113
PID 3776 wrote to memory of 1088	3776	msedgewebview2.exe	114
PID 3776 wrote to memory of 1088	3776	msedgewebview2.exe	114
PID 3776 wrote to memory of 1088	3776	msedgewebview2.exe	114
PID 3776 wrote to memory of 884	3776	msedgewebview2.exe	115
PID 3776 wrote to memory of 4764	3776	msedgewebview2.exe	116
PID 3776 wrote to memory of 4764	3776	msedgewebview2.exe	116
PID 3776 wrote to memory of 4828	3776	msedgewebview2.exe	117
PID 3776 wrote to memory of 4828	3776	msedgewebview2.exe	117
PID 3776 wrote to memory of 4828	3776	msedgewebview2.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8792B489DEBE5F0C04E8A850A00CDC3D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6D36BE751F29DF760754CDFB0BB435AB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4536
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AD69C37B3BD1A2FCFACACAEDD7CA3B8E
  2⤵
  - Loads dropped DLL
  PID:4684
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5CDA6E40560F92B29D133945B2212FE5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A783F78405FEDD05E33755DB8D6A8444 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3532

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=4432.804.6969966183646862582
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff7e0fb078,0x7fff7e0fb084,0x7fff7e0fb090
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,6260921091587431167,7335245939379354773,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1680,i,6260921091587431167,7335245939379354773,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1740,i,6260921091587431167,7335245939379354773,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,6260921091587431167,7335245939379354773,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:4828

C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys
"C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys"
1⤵
- Executes dropped EXE
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.6MB
SHA256 043e363ac3ed11ca47a21876b70b8da384f90dc8d71a805bc52efa3263227268
MD5 8cc74d6f70e7d6c958c7e20a8e7f21e3
SHA1 a9336696d6f45b7ed37057cc765d8b9adc8166db
SHA512 285ad2dc391c1255213fb2e4d434df8e13b68be072d3bd41a99758d13455c00c80a72999ed8ec6d1b21e35fe132de2607ada5027015888f4af5b2debc13969b6
SSDEEP 24576:m+uojr0cIAigVc5xIJaWExsIkiKRyfSqG8d6+BctEmpG7urKpsPVaN:Lfr5IVgVqIY9xD+ASqGK6+2tkPpQEN
TLSH
T104755B57B6B540A8D1A6C038C5276707EAB1348A0B709BEF15E08B6A7F13BF19D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 39KB
SHA256 6d6f727f3d0dd137cf09107ef1d3155ada62fae5e1e725d44a65ae85c36012dd
MD5 c01f3e105ccddb13bae143a2e4d88843
SHA1 17cb9dfb3d7504f67717cd5fb3b3b3415c5a97ab
SHA512 a91f470ec1afa45fc75b83ff2d94c74f0248dd72d644c560110691d98974440f2a2efd800ca2e25aad8ddbf8077b7b3140f9fd55fac80ca3def9048f1c1e3e12
SSDEEP 384:SWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/TjX:nwJTwYB4E5n/xe5arvur2R1dbTV+wh
TLSH
T10A032B0296BD8323DA995E34FDD0B8516BFCF7C379EAD60F500AD1E648863819A90D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api
Size 173KB
SHA256 3c8501465e2549e0fcd70c7997abd4c05f62a2e71561d8a587f9f50082d7e686
MD5 2b30259ced367088a32148607b8b2f1d
SHA1 b19ea3853c63e12b387e9005ea3391ae59856218
SHA512 d1b209b30672388eb3309c2fa155b258a376d2cf4a8daa3121cc241df64dd74ff0d29a4b3ece7e3c89e0c698c02d270c1d6f9dde8667b9d75412a8fb70a8ec77
SSDEEP 3072:ISE8zEmbyhtVsBUCsXLyBXBlieZXFN1DYNkgwk:ISE8nsXLQliiXFN56kgZ
TLSH
T1AA04E84BB36900F6D1BBC038CA975A17FDB238958774A3CF86514B661B137E0AA3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat32.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api
Size 91KB
SHA256 875d74cf06d0040038cf15e0c312a9921522573021f16dd419b5263679fcd019
MD5 7ebed667f8eaa6378d1b7fa98135674d
SHA1 a49d0f020ddcd3c5460401d7cf7e4d206e8c4937
SHA512 f76a2f719ac8d7e38d6c16a23b5262e3573d92965b276cdecc462d6804092e4c99a6afbd1ac5b498656fb4bce3e2b63b2abd06ad2c0c5728d2217ebac9d53a59
SSDEEP 1536:01LkqyqGWOGraAW3UkQUSJbfT3dHZtLhLmHYv/2WuJM1ywmhUN:01IHqGWObAKSNfDdZaYX2dzwHN
TLSH
T19B934B31B54CC032F9DB09BA9E7D859E9638B9610FE514CBF3882A4E0DA52D27F31527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 35KB
SHA256 46c76a0e911d24bcb0a8f01b55cf53014d8c92be6a3b3ec38890eedb5a1f9d83
MD5 07a1608e9f93835ac29be2156215f48c
SHA1 028cf9800f42eb36f1be465f8e5988f231d79b24
SHA512 f82e37e1ece6d61fd1e36de6d95870839c1de4515b5e5690396a8fcd309b1e45dfc4cf4293a67dbecda4d36064ba26db0c51c8cba8ddeb6d080c72ff36969f4b
SSDEEP 384:yP9CzFCCA5iirDlmz/3blTAY9I0VGWUhxciqY9OGc/uo6ki2Ki1uO8WTfNLbcrW1:uCpCxii1mrLmpx2Wtr2R1uWTV+wH
TLSH
T105F25C5756BC4113EFCB0FB9A8F2BA110978FAC669F7D60F841690AA1D033C05B54B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 6b9e56f7a9e4dfb0d29a808d6026180013bb96ab8015f3d5f1c0ff675657f821
MD5 0f0c266d546cbbcf77afca941fd7bbc8
SHA1 6d7813b3abaf6eb9c6026050e3512bbc9a2c8fc2
SHA512 022b1aa81c309ab17518bb626d66d5ecf9212214b1391ce22e927638e5a7ae993ec3650717f0fea06800308500f35981ec50543c67e34c2b43a3ea3a4a1c7750
SSDEEP 384:lyw5tUebz1qErhM5Q92rbYQujSQxrRjfU6ka03S:kw5tUebz1qErhM5Q92fYQKSQxrRrFk3S
TLSH
T1F5529622C4E4EE725B1712F17EE55C210B9E5323969D1086F8AD698FCF0C9D60B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 c5c3c51a227df1e6e50aac1e9f0b48d4b12c863869fe77f7023157b95dae344e
MD5 38a3c222a19cb351a5c4ad93a9399fa2
SHA1 aea79e926f41ce9ab8f5969171a6e05919257e1c
SHA512 10b0f66a2ad5e346fee3f8522aea1a767418408c836cd13c903c20dc8392b6babf2d20aaccc6df361c4aab81f349daa0957a622b234f0933ff9c9fed3fac84ae
SSDEEP 96:0WLwO9ZcA1BHKMqPkDDCIXmOwE1aWE6LW7ABIm6Ef+gbBDA:f3D+H7AD6KJA
TLSH
T128C1B8EDC6C8EC02F301F570BAF29913258537B341ED40D9AEA69C9E9B488D9C5513EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 33KB
SHA256 f3165d6942e2786b46680a1d9b2d3e3c537c95efd407077393fccec3acc79680
MD5 6c92e538b85b4504c4887de1ac3a594b
SHA1 4099e1e16bd4e0b2d8d11f3079016b27f387e86e
SHA512 9e98b372dfcb43f9c205509b772cf155b2ce8a8ca38cba7441e7afc02c3e2854db28b06e10206812e0e2ab93e9babccd94aeacf265190e6b03d2717adb41a739
SSDEEP 384:P5Vb2YAc/LlrdOrzK4CZnWJfpqFUaCtywJfp16fTSYj1XFRW1uoZg2dc/uo6ki24:BAYAoE2ekSlrCahtr2R1D+zTV+wT
TLSH
T113F25D93E75C4213DE8F4BF5ACE5DA110DB8E5856EE7DC0BA409A15D29123C02B78B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 b8be8e96750af5a350ee6a3d1bd5d6cb44bfa69a2b633abfd8f5e89efdbee420
MD5 0bdd7b1adea78df999d5c68163089d83
SHA1 45846fb54ef29ae7c16dad67ca893a0d638053e5
SHA512 b93eb194ec2ede028150678a329a6166c624fbf35c1aa6db93c607409603727ae1e6e16b32a85bce9dee28afc9476b571c0e48b79e2fda654f766b190bfc2c72
SSDEEP 384:dyw5tUebz1qErM5Q92rbYQujSQxrjfZZkEeH6r:cw5tUebz1qErM5Q92fYQKSQxrr/xeH8
TLSH
T126528522C4E4EE719B1712F17DE158210BDE5323998D1186F9AD6E8FCF0C9D24A872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 90d2b5b491d2f5a7f810cdd8b686fb14172a1c686c75d7bf87e7620e485072e7
MD5 339608f1146ef09168071a9b63d3d6de
SHA1 ec66bded2bee5313b8746dfe0946a8f7d1904768
SHA512 3e4ea06015e42fbb7b58c53a630527ed7fe5bb23fb35ced5736749eea00dcecc809a45431006bc11aaff8fe578aedc2b4df3d1e0fd559227f03f9a92a1ede7e7
SSDEEP 96:0WLwO9ZcU5HKmPk4oV/zZ3q1mOdtN4aWEZgNhdmSElOD2bBDA:fkvVMJBgNqStDkA
TLSH
T15BC1879DC9C8EC02F204E570B5F2D503268A77B340EC42D9BEBA4D9E9F44AD5D5123BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 33KB
SHA256 a6fcfc7a626346b8ccce4a9bba781def27f1a4fdf30f0a337f4ae95c60820580
MD5 cce65c06a59cfc195982468eed3ddb06
SHA1 84a4e5468aaad67fc663b638e43d462dad279ffc
SHA512 db2fb0814375ac7e516990c950059ad0c1412ab02059faebee943c110281dc2ea88a0b05cc2239c9f70313fac489b797016148f3db3a3d501f2edc881b4f71fe
SSDEEP 384:o0fy+7uHt+/qH2ilyYiii1JUpqqLJcTvgfRh0e3XgYie9Cz/uo6ki2Ki1uVbTfNG:f6T8G2rYiH1WpTiU9knar2R1MTV+wUp
TLSH
T1F1E26D8797BC4313DB8B5B7AB8E4A5114E74FA865DE7D50F9017E06D1D027802B60B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 09772571a4ac2f84ac5155910c349370fe663a61a315f3414c58288c6b062161
MD5 e8e602772ab6f5c002ed24e9e8bf879f
SHA1 4f8b0c986a98bd53d25789d73172bfbb10450a9d
SHA512 bd7ac26bc77207d0b778957c77f88ca91f14daa78d5420074fae6c6aaa329a59ce134627d405d835e8e143496a55cb20914cc66d141d42d0e5c110f2d213d0be
SSDEEP 384:Kyw5tUebz1qErMm5Q92rbYQujSQxrjf+tklVArvg:Bw5tUebz1qErMm5Q92fYQKSQxrrgYmDg
TLSH
T17E529522C0E4FE719B1752F17DE558210B9E5323969D104AF9AD6A8FCF0C9D247832B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto
Size 5KB
SHA256 2b9d6e71e2bfaa45e9f7f82934a1ca44716d746bee68c3ff142071f1c30f43df
MD5 07a801433f18e38a5b83dc74919d4872
SHA1 6f4a498824217f43415819f60eb864ed6fc186ea
SHA512 0e29c5eb24c4f4562af65b6c18c6751ea9b8e0736693e070c29a7315c5e33685d60427fe2d19364431708a1ae0234e433ea9f50212ce360f2b8648511d581174
SSDEEP 96:0WLwO9ZcS4HKaPkSrnSbKmOAeaWEveMOSbKMmWEiSb3vxbBDA:fVSrgPeo2WQ3vHA
TLSH
T1DFC1959DC5D8E842E300FA707EF3D4032589277344FD8088AEB94E5E9F48DD4C6513A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.2MB
SHA256 10bf5b106de60afde0b21772faee3c8dd61de75d8943b2cd325658b1fc36699e
MD5 a2868a966a4ce7b03fc118cab0071022
SHA1 6489c437dfe6538907ae1d656e62a71cf8829a7e
SHA512 e82fc5f292a4ee17ee8ecbe51a56bf56236ba5f8a28626372441f88bb0295211de03e0c17bfc9fca16e42eef0e2d46de05346e1d054a1f145d3a01b659479031
SSDEEP 196608:5fAMRENS1dwsnBxFg59m8HnMX+I804UtBRdQePw/seRsVj:hENS1dwsn16EmnMX+I804UtBfQWxR
TLSH
T12AF68E6A76A800D8D0BAD0BCCA5B5713E7B2B845037557DF17A096BA1F37AE44E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 217KB
SHA256 f9d0a937cb71a55031cf4863a5f4d0006d87bf3b21c6cc730764a32edcb7061f
MD5 a1d016fcd61b87425e4c5e1198b3cd32
SHA1 a4a81a8d3d1c78626529334ac17c19872d89892c
SHA512 641df91928f69cfc7e5c4d0b6b1c80b492393d8315d12bf6301ea7916c614cb897901443062e242e62df9b752b24692bb85d834e84b74af5cceabd89419ba41d
SSDEEP 3072:jW95t4/CbZ8Mqatj5kDI6E3bhjKPIa6vvpm2DQwrHF+ibXDzukibw0y:KDW/CeOeP3K9ZnuHbA
TLSH
T137242863B26800B9DC67823485A75A01BBB6F8450770ABEF07594A7E5F2B7E0DD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 175KB
SHA256 b0b9df44e285386d3475bb722eb2bfa3dcf9273da3fc2613681673f4394c684e
MD5 b2fdeb8e2c137e9842297924052ae87c
SHA1 484eff5a5b5c9821fb82323fdd15c0b687307eb9
SHA512 3888416963889c2e4be5f7c6dce1970abc0afd18e1048345a7cc9c3ae8a3a497aca7b1c89b762d334873c756b95b8a7986b08ca1c26337c9163ee463791da91e
SSDEEP 3072:G9p1tpsZpdP9RvOBtnv7ZDqR7LtamqX0abIV1AfMqUG9qwU+:G9pXpsB6jvdD5mwYOMqUG9qG
TLSH
T1A1046C0273519171DBAF45B41D789A739B7EAB20CBF158D733845EBE4E203C9AE30A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 83KB
SHA256 bcfc09061e5039d6661f16181dd6776ed85d89839a7d6aae7a04450cb41c5bfc
MD5 5500fd92fb430b17168a7412ee897106
SHA1 6c24a9c784f656a01e24dceb139dfbf8e4d404db
SHA512 ad7902d8dea337b3f72ca8d70f18072e136db29f852227b00aaa5da0128071c69a08e486c468243ac9271f47199c391fcf1124d15b3cf7cf6dda9285a63806fc
SSDEEP 1536:hGT7rg4dKKVidHmQcJxKmDj333Xu2GM1BOfw26yzK:h+jKKVocJxbLGBwcu
TLSH
T1E483F6F2226C44A5CE968634C1A7DC22BBB1FDCD172147DF02C6899C7E92BD15EB861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 71KB
SHA256 c5d0a255c4de23a5a299669f188276b5296bbea54871d74f9bfbfccf220dc583
MD5 cc6cbcc77ed8c1780bd7751cbd4bd397
SHA1 0fa7e2de10aa75c7a436c961e444dee988315cb8
SHA512 962b77914e598ce53617f26884c6a7719074e3e465d92b615e14e81cb616472f101339ebd9c8a1003b2a03bb131690014866ecb027515323e5fd233355fa776f
SSDEEP 1536:7GJNmwl5UCVTaA3NgIFV5kdM14Ww8RSJMzw1T:iJNmwlCA3NbFTCDWw8gJMU
TLSH
T143733ADE990003B2D9DEA9FBB3AF6733356E675007F510D7A14A49A5080D3EA7E38706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlp.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll
Size 850KB
SHA256 e3ad205b1462da42039d10578ed13615dc614a6c51a3221bf5b468a753648861
MD5 994c46d6c84628b4ed9739653e3f2126
SHA1 b0461935844d8ee45cb146076d555af854d86b18
SHA512 95858566368d65c4987f5ba98f22843b7a1a37e35096d8f97f917217e9fadcbbf4010fbb14104aeb5361dd3a655f2c20e76fe645672bd5b39507056d4743183d
SSDEEP 12288:7AMU6+GxzVk6Dar4e9oMQhsEo95buRPgHCB1NlXM:7AMN+G9OzoMzbuRPJTVM
TLSH
T163055C3BA66C52B8F0B7A1B892EB5911F775BC1623A055CF436049793FA7FB41A39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll
Size 698KB
SHA256 88e7e623664066a149a1d206d4bcd08195094078a9246459d2699cf819ec87a5
MD5 3a3378a37bbcde831a0952cf0006e5fd
SHA1 8442fbd5505554131eaefcf3d833b9666add169b
SHA512 19927e8473af7b3add0a6cacb11d07fa7853f6e1eb29e7bc40a8823ffbe7259d269b6f9f80a2737904554ac99d7637585cb9b5553b49769bff80d7471a9d1046
SSDEEP 12288:YXVkoEspfLTN37IqXP9Vo9/LTopq6lpUs5PQct2S416Or4ZEB:YXFEsBl7IqXP09/LTopl7D6ct2SW6OkY
TLSH
T1C2E47C3272928075F8DE57F12559EF7666BC29322B7204DB87D0AF7A4A309C09739F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.2MB
SHA256 c2b26f9ab549362ebd69d1991c6395ecc380fcd36a6720d2abdd51998b513bb5
MD5 7f0370c45312a999afa5fc68a9b58a59
SHA1 f3d59c4b0983de4918c6c72b398a07144d8450b8
SHA512 ac833aed95ecfb5755e804717746753df8d75dacfd284eba331051a2922f85695bc027813c584881c1d657a11ad19e193a6a5962634bc690d4dc93fefc3866c2
SSDEEP 12288:sIRpVQ9ALn2ggBHvbfeN/LD6V5l8QG8mcigIgqbGtphBMmOayJH4OTcculDw:syDQ8gxj2NzA7abGtphB/OBH4OMlDw
TLSH
T14455E961376B2F23D65633B9FBD31EA1A3346C463759730271DBA0110AEA24CB2E79D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.2MB
SHA256 a059ea151d9c2b069632e83670ed23946649a9e3e7d75882be419586b6c61b83
MD5 4e1096c526f3aa59474911d082600f73
SHA1 f0143115df95503668e79903aa939f4db2953928
SHA512 bde893a4de2bf8bf0d680a38f783a791cefb456e242b9080787a937b9af7062efb79ee710d73cc6057804f7189478c0c2df5d239a055e83b6d9983560550df92
SSDEEP 49152:PGtlqni1VwASOt1vwHhuJ/q9uQ6HazSRWGv3dg+sfeGo+ohnzgpXz30+Knjw1Q0z:UuHoC5Qqeaohg5z32qJg0rVT+ir
TLSH
T1FD469E69A67C00D5D4BAC1B9C2865227E772B41557F05BCF1AA086FA1F23AD01FBF780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 3KB
SHA256 e79d4ba3ae6037f9aca03d3c9474ebd5891bcc1dc1257b5ead90e325035293b8
MD5 f79721c6eb2d882b9c778e16296b8149
SHA1 deb536573ffe839aa2234238c7240987b924df55
SHA512 719a298563ffd47f3a64b480d5d15c20bf23b9aaf325dcca1b99e389d36131db3c9eac081f5d75b722292a6b4379f9f9843daffbcc657cf5b782da285d08cca7
TLSH
T10661EE58A7A24A78E98B33607F133883B7657080E0F8244177EC9189D3D2D5EC5B1BFA
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 238KB
SHA256 86f5c40d332bc04b01f5ed4ae4d8a5a3445e5069c471a186234b6585a971d97d
MD5 c308baa10ddac9f78f174d42e119c9b5
SHA1 72e0a272123abb990201841a172dc8d0f6032125
SHA512 374e1790923d7f2b3324faac8952547c3b9348f6df9f5fec9cdcb2aea191ed1c7034826b12c1e167a9806f98f59bd083c21a2da31ad7f200b2b3a27e8d75b421
SSDEEP 6144:EbILqAXNojigKhI0uFpbuvHahWLSFTbejfHy:EbelXuVKp1L5+
TLSH
T188349D16A39509F4EAA78274D9B2C613DAF2B8452322C2DF039486581F37FD0F97DB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 78KB
SHA256 5c5b7f15ec998e9d4c64b831075ecf928e31ee3864f959642e8487c5d6da7281
MD5 2f682a669eb07e0df9f094d78936d5e9
SHA1 55b19c5c8042a3f05224bfad78451b88d50ac600
SHA512 e8cb99e68e0bb8bfae178983d34595eb30cabc36cebc86749fa7e18a24f8a36268c988d637a18ffa34358d541c1a5a1e4311002bcf47d623d919d7b36f1a8a06
SSDEEP 1536:o1Yv0H2UZyO3gHTnxAnKa7cV0FHZL1iCYpM1Ow70vzB:cPEO30nxAnKa7cV0FHZL1iCYpDwat
TLSH
T13673F56262A40CAECD1192348CA79C12BA79F54927E146DF024E79ACCDD77E07F3C629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 68KB
SHA256 77a4d156ad9e0013f874eb84257068ef8bd170b5f020a9ef087b51ba71440db3
MD5 8b166236b367ae4802b38fcd3d4d1e3b
SHA1 159386a271cdf398b7997758fc28066d9eec061c
SHA512 cd3e2373248b5d94514be1fa25f42c6cf763270eb535b75a164b5030c90872fad77c53867c175f96c6259e09bfc2869bce0bcd3e900477cda26311256ef1638c
SSDEEP 1536:NCohO6pg3Kq7slCFHZL1g3JkzM1YwRFz5:26pg3Kq7slCFHZL1g5o5wT9
TLSH
T1CF633AC2BA1801B3EEEC5C71B6AC35229D695A101BF684F36D593A888C07BDD7E34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 2KB
SHA256 4d0e65f8712b7258ee6711a348a50c12fe45117b7f8495b558777d0bedec53f5
MD5 7fdb92eb17ffc9e3b0c733a9a3d79198
SHA1 967db401e658136ccb369290b9d6d5cbe221ff3d
SHA512 77db02a848e36ae828f39681e51b2dd662a7225d2bba5c150dc8a5069cf2222950c207713356254d578a8c31af4c54a09743f67b780d4859d221082261bdb7b3
TLSH
T1B851D476BBCB587C2CC48300ED17B93219EDDFB8767615A043D49D414CEAD6BC21A8B9
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 17KB
SHA256 8a982e784b77f46ffa47bbcb5da268fb57af148272aefb8efe471b3fbcbc6223
MD5 47ebb891c37cd4cb028fb92ca552cf9a
SHA1 536bda30cfd7e585e9556ab2592eb3e29c01c236
SHA512 3f541aa67cfd55ed1620f888fa8e9f9ae428f5f085e0567037a88d84d491244afc9760ee965078d7501339e2158c25e150e02ca66ae27c908fb296bd5ce07c63
SSDEEP 192:QApvDi76mtMVgbTY3ofKuWvZjeJ82PFl3lYl5l4lRledTb4DQbSbWvWjIU1yqJ/U:q1OPuXh9+krjkY+5
TLSH
T11C82E384FB4BC57C3DD013E1DB1AFF812AE4AC0972A31972BBC58E4E5AC185AB149871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0766DB9AB186806BB9A6B6802D3BA734
Size 2KB
SHA256 67074b6abf9269cd3be0cd740de8ce3bf5eafbcc7d80d3d24aef34af526b1952
MD5 00c3e9a166fadaf6963cb6f4d0e1a713
SHA1 8d2985b26d6ab36e736dd8ac5ee479df379c64fa
SHA512 ba50e197ab4b69506a1ca234ae356ef503f2a716920751774773516b50f38ec1eff0859cd7b2d0764eac47aff827ae9865b6f36ab4165ed85576724d7a5f01b5
TLSH
T10C41EF4C91513523E148BFB2DECABD8BCEB1B78267C9C50F9DA01E421425FC85F984A6
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 1KB
SHA256 0a703e26cf30c928c7489722df39b11b3e60e976c6e2ae9d3a97717957952fd4
MD5 f2e5cec2af5b6bf728aa060682993ab2
SHA1 6ff78eb20e20037293de72506ddd7eae57ce943e
SHA512 ac437f56d6d96d22f9fe83fa5b5f8ed3c9af01314ae97ebae29ee9c7a4eb332e0b1f971a483e064e3fd1fef56aa6545e7e4ea8e0a992c890cfcad28113ddd80e
TLSH
T15931FA4B121E3D4ABBC78E285CC679106D3994E029EC6922257781BDBA503E21BF941F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 00dbc5e57acc52429ab7748f90f145f9c2527fad0771a95fdb0ead6b78f88ea3
MD5 24f56f59afe85fee2d964e4506f7771d
SHA1 ff60d065cdd5987b5840b9583e2f32a5b6bff041
SHA512 835800a5386be5302265fbf0db5b249250e0cd58c09f82f3262924de475ed4ffdf3cb6a3b7063254bef708198a1d0925a58efb3577918a33c599b0366f516e5b
TLSH
T18931FA3B0F3D5911CE124DA426C9FAB61971C9D12DDF207A31289A1B2881BF64F15D0F
MD5 SHA1 SHA512 TLSH

Submit Download

0766DB9AB186806BB9A6B6802D3BA734

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0766DB9AB186806BB9A6B6802D3BA734
Size 192B
SHA256 90e41b9db98145ed16eb0ec7bd4c057210fcb2af931cd806edb8510f8d0eb580
MD5 4dcf36a48b13686378ac3cdbe246468c
SHA1 1a6fdeacc40efdbcd44278ac2ef147c1bb23c04e
SHA512 058ccec1c47c12c8b0f7d595cc7c67d10002b0cb71f06fb577cb14f7fe814ad37e4cfb3e6c666c2ac8e275525b55f8c97a73c27ff6d1d2005e2477743cab8af7
TLSH
T187C08C01A3749359F01547BA3D405CBB5BB25F8383A3CB9C0B21320CA87AE004A70F22
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 540B
SHA256 7cd5550d5639d3fddd16e4b3498354960fb53c2c5c62697b2708c4b2405d4652
MD5 5510bd1c42c11cc869d398b4430ea5ac
SHA1 b133b81f2d3d74f65e4e1ceb36b1742f15ac69df
SHA512 b1b6e427a9562ada8bde6bf7c001013d87c243ad62ea8edc1f0013243dc1f574b57e8760934a3a5c07b145f0b6a8077795815f5c267877a261825127c4958981
TLSH
T162F0593811FA401EF03ADD3447E1A6969D25FD121821564D19A80308BE21F402C93B36
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 d67e2abff19896145e05f819a55c09d0086668c23c5c8bdc018f40f488304b06
MD5 2c933541430fbfee0c1774ee691cd060
SHA1 808542595a4082e414e75eb53c84e1d0bbc610ef
SHA512 8a40a0ccb4646fb5ea7c44be4ecf71dd9e7012d9df34c3d4184760fba27a5407462a1ca05bb45a85b8e6c2accf5d937ee106dabb28f89633ee6514ce05636019
TLSH
T13CF09E2409F1821DF077DB790AC55967F616FD023C24962502624B1B2962B408F2743D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI19C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI19C8.tmp
Size 5.4MB
SHA256 5a14eba49f4a5c3df14a26a39ae9bf1416759cd9cffd668943ad88c1a7546e9d
MD5 5885b6106ba4aba80086079e83f56496
SHA1 1c7c0272766bda867d8bc85f103d01cb51e3c398
SHA512 f38d82efaecc314449b26c4dc661161cb5ebf7edf54f7b1d422590946859904d113beabd920c70e922bd7d9728d6f608023a7eee98d88895285374ac09896782
SSDEEP 98304:4y2HkVo0JkjFwS6tQ8/xmCnZ98gxBJzemi4YyPkZiVD:4jkVo0yjCmCQ4vPkYJ
TLSH
T1AD46AF22BA01C071D59D02B125BEAB7A892D6C34973445C7B7C02F79D9211E37F3AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f458d540a99237f64e13f7e34d1174723d795178acb5f7a515b1e936b1be559a
MD5 48d2b58b8c274aaf4fe58409c6226751
SHA1 5ca7e2550d3a9db36e7a96d94958ace2c636d165
SHA512 905630193d1134c22e3cf01ddc7e570a3103e4fb174a9eab54c18ff16cdaa8785fec2a9206a55aec032fd914ae76b32f5828bf1cdae37630729e9055b1d55ca8
TLSH
T1E0D0121372124134C4213033004262082800C20B414540455C298D1D1A040A01D064C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences
Size 6KB
SHA256 d7c24f43ac4b865180c05c8a2a706e7c22c43475a085b7ede4b55197fd5ca8c7
MD5 2120a7545b46e2533a1d0baae0864da9
SHA1 b61d84f0c95b2ddd476d24e29685ce7ea49ee0e0
SHA512 08bff4c2e5ce0d184e44c7b723c69f844a725a5711f63ae97e63b76a6cd1bb13e123124e42eeb0845194db4cb64842206f8a5a0ee25c3750a1a95bba8718b2c2
SSDEEP 96:stw05UfCGb94VffKZ8i0v2KEvklm/7qx+WVHMSm+uecadQjG+gMokMOYL:stw06OVfCZ8puF/S+Wi8dLnkM3
TLSH
T1C3D196135F6C69774CC7E6197A25BB42E2F5602226D50E98EBFC870C05E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2dd8.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences~RFe5a2dd8.TMP
Size 6KB
SHA256 29467e9bd2e999ef50f9192181564e7cae2f7c666a74a23534541fe3dac2dfe0
MD5 4619f2ea6b6695675c1f27b9c354c002
SHA1 01743ee0e955ec139dab379a98f8a2317ef1c190
SHA512 1b73ba34362ed82a60d732412a7047efb1893dc2cc09714f9d916d28855866da93c006b9757166831332b5eecd4720e4e4cfbd53e58ff8d9e787e9443f64ce7f
SSDEEP 96:stw05UfCGb94effKZ8i062KEvklm/7qx+WVHMSm+uecadQjG+gM4kMEYL:stw06OefCZ8pvF/S+Wi8dLpkMF
TLSH
T15AD197035F3C69774CC7E219BA35BB42D6F9606226D50E99EBFC860C08E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 1KB
SHA256 8ea2a2b8424b6622dc11ee4ac3ceb09bf6a35699aa46f6c2ffe02e5a4d57ce21
MD5 a4903e6670145a05bd8c2bcb8ee2f505
SHA1 b996b340ddf6de5158e8b1dce490b33e7b22c376
SHA512 a2313f168efda2be8d09016622c90506ea5204ed28b7e502882b1a1f429f19c25a4ebd2cdcffda158f96cd754b904a94c2a09c5ac80de6e32ddee2da5e5409e2
TLSH
T1053167B3A4E81F315E926A54F781BF873F21516A82514F04B1DD0B1802F36DC926EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 2KB
SHA256 daa35e75d3bca8e6739d40f75cd67b29203231f59e316f514cead79cf183bb99
MD5 6acad61085f14a5735b331d7c0e77d98
SHA1 5e004509b4044712a604f81c288e990ac2d7c098
SHA512 e44da8a95ab494192a60773e21d35597d3b13cb2099e778e1de381ee79666cb6641e431f66cfe709e908fbbf0ae62253ec387903e85cd922295f13b558507fbc
TLSH
T137519573B8989A368EE35E04BF863F536F31916597921F50A5ED0B0C01E769C2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 89bef6b4e1308f5e5926afbb7e54c3122e0fc7503c9bc7d991922499952ba462
MD5 9966e5b521d9ec83f47505f68a9265e7
SHA1 7f88e10b9a17423396351f36c1fb937bedabae7b
SHA512 fbf50b19602872417f472215f71eaea44a5552c118577fdc95cb73fd964e8dc1ace802e4a30e1f8730e770b78a0aab3ac30c84b55d8f41945a93f3dfc73de4ca
TLSH
T173718533A9A8A9374EE39E04BAC52B177B615127D6D52F95E5EC0F0C01E77D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 16KB
SHA256 f9d4da8ad57f05decb469b4fee8bd657d8ffe6846ed729b47021f4591776aa2c
MD5 ac40ff29dd58a32a2f1e87903f895911
SHA1 a9f0f18ff22179c62ffb233a91374acad5ae1f3f
SHA512 c793ac248e83298152f171a7768696cb4ab761414af0e1126053d3d0633f7bdf54d66f3ee5a67e907ffa89d7863569841d1c8eb923e8352fb37808d9fa894847
SSDEEP 384:zK8vsrvyOiyp4+IWA1eUVWGfvvLhNbRhPbBldqvzJVv4P:90raxyp4sQe6WGfvRhVlAzJu
TLSH
T11472B0B116785A378CA6BD4ABDCA291B7FA48966DEC11F94F1E09F0F011B2CC174AD07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe598f94.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State~RFe598f94.TMP
Size 1KB
SHA256 1538fe28f0507b27336fefe10d225e78a4d6321abe76cba3643d8d0344951480
MD5 fb8728edeaf0a6856a05819c6d535af8
SHA1 8d586b09864226a42744b3c2ceacf3b6027eb5aa
SHA512 85869bec592abace1f89967106227a17348cf1be232ca5e38e18c877ef62f306c81a563aca462636265f97428d08f36600cdd91bd6b3aa0e2f2beb46cc2b681a
TLSH
T15C213573D4E86E316E525D14F792BB873F61916A52514F08F1DC071802F75DC926AC37
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 782B
SHA256 a8183a708cac1ca55ec0b861dc4757c1fe9787b99b965c9bc7e22874b2964204
MD5 c212440857c946f2a24f60741d6555a4
SHA1 ec04342c928fc543e33ace8aaa2ca8e70c5bfd3c
SHA512 b6ef07da15ccef5cf9cf60b7cac4f61f0acc1beae14e53c8a95c3c9faa80db070889b866e940f44ff3f97715687b17635d7b069eada329322e6aac3dc59b72ad
TLSH
T147012622070A09EF08152DF2DE8EA63BCAC26F5C335F4525B5FA711D3A48221A5AE4E4
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 9KB
SHA256 66775390a3c4ef0e6e6941fca878a997b5164fe5814ea60980bc6a98dd86452d
MD5 dd38bb694a9a623831aab945f7b1f609
SHA1 13a176e1c53629122bb815a4a59fe0c5164f0095
SHA512 7cba2518d1a47bf4709d1f6835b9feb72def553fe9418bda14a0f6fc8623f6b5f1de980dd6acc69d2559b3b6af9aa0016ad01a216da7479ac7bd1b213fe8ab9f
SSDEEP 192:qTPgzgs+ZujWsP5rtAWZlDdiYglyZ8Oys88yB7ydIIyzz3hTdRQmaCH1GhcuKCqz:d+eZBlgcZWsaBudwC/kPMpEkk
TLSH
T14A12AA23074505BF08560EE2DF8E963BCDE67F1C325F9614B1F9A5097E8C212929E8F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 1KB
SHA256 5acc7dc2f58ab3f7b166e345eb9923ecd5b9666e1a5b0d4509c766d41abc3b14
MD5 073c94bb1a47b0acddfd3ce562512ae2
SHA1 11370631e6babf39f8075192013cd12cd57a66d1
SHA512 d0d1250204514e83e1709eb31c5eba5f544e2dfa2aab3bf46ea6482d6e146b67319366d60e8916a150117cd19f0962d862091c456b13c162d058dd622a32a7b1
TLSH
T17A31E831430316BE3B1B3F8AD787DC25C0D2B942E38D1365668FA1066B445C0A96BAFF
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 2KB
SHA256 c421df8a492114d2c3458623d25784699009e506db9600106a5cce15f682a4e9
MD5 62717ac41ff47cf76ed14c9e731c4500
SHA1 30c8b055c62c93f00274c103f9f70daaa0a4cfb0
SHA512 9631d74a13bb83ea1bf02b4676a2b6cc5a55ce30b0c2432ebfbfbda8e8a6061b50a9883ed7146516d2486ae59ac18d659dd64ee804814a2a796b2fa01bd7ec4a
TLSH
T1C4516C31470316FE37173A86DB8BDC358591A945A38E0366779FA10B77080D0756EAF7
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 ef8684ba927ec891672cefa7a8f7b052f2b29e037ac06dc04003f19291207dd1
MD5 95e4eb9c7d72f46934ffd3ccf9f0931e
SHA1 a4560c5366d15a09882429c0ab7ca0d2727c77a0
SHA512 fa01f70e8638edf4b65e3cd758f279d5ced94693f253f685df3e15dde1bfefb9a9a31a331d22ba5f6ef7af5bfb622b1ed8e6ba82bbc6568ffac4f77a3b3b70ed
TLSH
T1C771BD31470716FF37173A86EB8BDC358681A945A38E02A2779FB20B3708090746E9F7
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 7KB
SHA256 906fcaa09978104ee806f8d53f4baa79b84f9ee6babbaf8432dba334d13963b4
MD5 9e1e9cf8289bec29b411ee0f110954a5
SHA1 a78a5dbc909743a5b6c14f6a6c6b2886b574f88d
SHA512 3b850d52261315e8e100a3ba09ed6ff3ddff5b835f52705e4d8ac5bb0d002e306740467151a9a8adf26c39022995ffb36f390c0687313a68e8cfb5399f644d0d
SSDEEP 96:YwYwtrspFsgM3BhS8bcSIdGk27oocqdZx3NHAVxl:YwYwtYpFsH33ams2Zx9gVxl
TLSH
T173F18B31470B15FF33532A86EFCFE8355AD1E604638E01A277AEB20B774809165AE5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI703C.tmp

Path C:\Windows\Installer\MSI703C.tmp
Size 574KB
SHA256 fd57011021e68f8c1203d206c056d8fc2cbd573e25053a6202debadd28468ee7
MD5 a2a5a45c70428d6ce0374814dff70d6a
SHA1 c85308354b9fb91dac5f5a27fd232a9194ccf217
SHA512 70d203ab7dc1732b558b88eb11325bbb3fae145d7447e5be54987296829447edc0fbc3f6f22b4fd25f04a7c9f52b28cc4e7e14677fed709e2361bdfcc9c224a0
SSDEEP 12288:9yEECCI6+immO9k3AFkPHph0lhSMXlUpU3+1:xECCQ9kwmPJh0lhSMXlH36
TLSH
T124C48C16B3E902BCE0ABD27888974A15F77B780503A15ADF03A096632F677D19F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 9d6ed307bfb632e812297bad1447925a26372258a1225ddceb8abddd31daf328
MD5 0f85240f296a2f2640c8f9c3d17235c2
SHA1 98a8cbfa1d28c46d805d3f1df95c0b1f48295785
SHA512 dfe3ceeded5dd1aa9a862f39b34cc17ff343a67faebd9e4d4ae999d518fdaa0c797e9a067708fa3cafffb7cc817285dbe4c7dea74828f3aa71062ebab0d4cc0d
SSDEEP 24576:uu8m+1zrdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:a
TLSH
T19247B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{09ae5c4d-cf57-4eee-874d-41e6cd888420}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{09ae5c4d-cf57-4eee-874d-41e6cd888420}_OnDiskSnapshotProp
Size 6KB
SHA256 60985de0cfc7448f8b5a996c0c9f42c0e0f7db72852250acc823260392327910
MD5 ed6e2d70c5c367b930380a069d3861fa
SHA1 78499e6a84eb445b32d593787a0bfc92673686e6
SHA512 9277e44a0e968c45da1ec26085cb5d9b6a5a5c2c827edea69c2b6f4225e91824f18295df0c727e2bc912dcc594eb1e231162e9afd6e541801a77c04daf6009cd
SSDEEP 96:FO4FJYGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:w40GPGnb++ZVm
TLSH
T1C2D198085AE54711E2F3AB3128F18557A877B911EF33CB8E0198638E2671A10F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-999-0x00000223DF2D0000-0x00000223DF3FA000-memory.dmp

Download

memory/1088-599-0x00007FFF9A5E0000-0x00007FFF9A5E1000-memory.dmp

Download

memory/4432-1168-0x00000000008A0000-0x0000000000FA7000-memory.dmp

Download

memory/4764-636-0x00007FFF99840000-0x00007FFF99841000-memory.dmp

Download

memory/4764-635-0x00007FFF99830000-0x00007FFF99831000-memory.dmp

Download

memory/4828-719-0x00007FFF9A5E0000-0x00007FFF9A5E1000-memory.dmp

Download