32c4832b0904cedfdd2d73c65d5e85a8d2f2f4f5e16894168fe2f74bab1e7770

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 35.1MB
Sample260516-gza2faev7r
SHA256 32c4832b0904cedfdd2d73c65d5e85a8d2f2f4f5e16894168fe2f74bab1e7770
MD5 5c5190f5718b966b88877c7d3104282a
SHA1 75b439975887509ed06abb06b383b3bb7ecd965f
SHA512 009c10c5230119eda0c8b6cb40dd584b9eccf058f5380dfe3cf9e06bc6c8305af6b748f08f6e49ade37ed6c0785b2e8e9fdf2b01406baec4a137a75ea2abbb87
SSDEEP 786432:hST9okpbfcL5yAoGsnDEttuQ1eiBuct8dOns:ho2k5cgAoGgottJIiIQUOns
TLSH
T1CC872322BA02C031D59E1171E56A97FA897D6C34C73045DBA7C03E79B9312D23F3AB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5936	stadrv6x64.sys
5964	stAgentUI.exe
560	stadrv6x64.sys

Loads dropped DLL 19 IoCs

pid	Process
2132	MsiExec.exe
4252	MsiExec.exe
4252	MsiExec.exe
4252	MsiExec.exe
4252	MsiExec.exe
4252	MsiExec.exe
4252	MsiExec.exe
5196	MsiExec.exe
4252	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
5248	MsiExec.exe
5248	MsiExec.exe
5248	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5484	msiexec.exe
3	5484	msiexec.exe
4	5484	msiexec.exe
5	580	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\arm64\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nstls.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker32.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp-collect.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp_man.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-fr.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nspacparser.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64ipc.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfprinter.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfiumx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.inf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker32.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tramp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat.api	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat32.api	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\chromehelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\DEM\demAgentSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinterx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfprinterx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx64.dll	msiexec.exe
File opened for modification	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-de.json	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp-collect.exe	MsiExec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF60EEF001C367B7E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5D388E1452D7F446.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD45591A27405FF0F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_952504116\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_548691919\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e58ff4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5A84B56-9BCB-4B87-8F01-5E135229AF03}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI224B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2ACD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B1E.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI2064.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2579.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2637.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC4F4A3A5599201C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_952504116\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI6B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2647.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81CC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_548691919\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI1BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI681.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_952504116\crl-set	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e58ff4a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2ADE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_548691919\protocols.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5484	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000035d00ca4488ad7d50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000035d00ca40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090035d00ca4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a35d00ca4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d35d00ca4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a40cd035-0000-0000-0000-d01200000000}\MaxCapacity = "13092"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a40cd035-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237365737725654"	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a40cd035-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	MsiExec.exe
4656	MsiExec.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5676	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5484	msiexec.exe
Token: SeSecurityPrivilege	580	msiexec.exe
Token: SeCreateTokenPrivilege	5484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5484	msiexec.exe
Token: SeLockMemoryPrivilege	5484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5484	msiexec.exe
Token: SeMachineAccountPrivilege	5484	msiexec.exe
Token: SeTcbPrivilege	5484	msiexec.exe
Token: SeSecurityPrivilege	5484	msiexec.exe
Token: SeTakeOwnershipPrivilege	5484	msiexec.exe
Token: SeLoadDriverPrivilege	5484	msiexec.exe
Token: SeSystemProfilePrivilege	5484	msiexec.exe
Token: SeSystemtimePrivilege	5484	msiexec.exe
Token: SeProfSingleProcessPrivilege	5484	msiexec.exe
Token: SeIncBasePriorityPrivilege	5484	msiexec.exe
Token: SeCreatePagefilePrivilege	5484	msiexec.exe
Token: SeCreatePermanentPrivilege	5484	msiexec.exe
Token: SeBackupPrivilege	5484	msiexec.exe
Token: SeRestorePrivilege	5484	msiexec.exe
Token: SeShutdownPrivilege	5484	msiexec.exe
Token: SeDebugPrivilege	5484	msiexec.exe
Token: SeAuditPrivilege	5484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5484	msiexec.exe
Token: SeChangeNotifyPrivilege	5484	msiexec.exe
Token: SeRemoteShutdownPrivilege	5484	msiexec.exe
Token: SeUndockPrivilege	5484	msiexec.exe
Token: SeSyncAgentPrivilege	5484	msiexec.exe
Token: SeEnableDelegationPrivilege	5484	msiexec.exe
Token: SeManageVolumePrivilege	5484	msiexec.exe
Token: SeImpersonatePrivilege	5484	msiexec.exe
Token: SeCreateGlobalPrivilege	5484	msiexec.exe
Token: SeCreateTokenPrivilege	5484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5484	msiexec.exe
Token: SeLockMemoryPrivilege	5484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5484	msiexec.exe
Token: SeMachineAccountPrivilege	5484	msiexec.exe
Token: SeTcbPrivilege	5484	msiexec.exe
Token: SeSecurityPrivilege	5484	msiexec.exe
Token: SeTakeOwnershipPrivilege	5484	msiexec.exe
Token: SeLoadDriverPrivilege	5484	msiexec.exe
Token: SeSystemProfilePrivilege	5484	msiexec.exe
Token: SeSystemtimePrivilege	5484	msiexec.exe
Token: SeProfSingleProcessPrivilege	5484	msiexec.exe
Token: SeIncBasePriorityPrivilege	5484	msiexec.exe
Token: SeCreatePagefilePrivilege	5484	msiexec.exe
Token: SeCreatePermanentPrivilege	5484	msiexec.exe
Token: SeBackupPrivilege	5484	msiexec.exe
Token: SeRestorePrivilege	5484	msiexec.exe
Token: SeShutdownPrivilege	5484	msiexec.exe
Token: SeDebugPrivilege	5484	msiexec.exe
Token: SeAuditPrivilege	5484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5484	msiexec.exe
Token: SeChangeNotifyPrivilege	5484	msiexec.exe
Token: SeRemoteShutdownPrivilege	5484	msiexec.exe
Token: SeUndockPrivilege	5484	msiexec.exe
Token: SeSyncAgentPrivilege	5484	msiexec.exe
Token: SeEnableDelegationPrivilege	5484	msiexec.exe
Token: SeManageVolumePrivilege	5484	msiexec.exe
Token: SeImpersonatePrivilege	5484	msiexec.exe
Token: SeCreateGlobalPrivilege	5484	msiexec.exe
Token: SeCreateTokenPrivilege	5484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5484	msiexec.exe
Token: SeLockMemoryPrivilege	5484	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5484	msiexec.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5484	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe
5964	stAgentUI.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2132	580	msiexec.exe	81
PID 580 wrote to memory of 3980	580	msiexec.exe	85
PID 580 wrote to memory of 4252	580	msiexec.exe	87
PID 580 wrote to memory of 5196	580	msiexec.exe	89
PID 580 wrote to memory of 4656	580	msiexec.exe	90
PID 580 wrote to memory of 5248	580	msiexec.exe	91
PID 5964 wrote to memory of 5676	5964	stAgentUI.exe	96
PID 5676 wrote to memory of 3580	5676	msedgewebview2.exe	97
PID 5676 wrote to memory of 1220	5676	msedgewebview2.exe	98
PID 5676 wrote to memory of 1220	5676	msedgewebview2.exe	98
PID 5676 wrote to memory of 1220	5676	msedgewebview2.exe	98
PID 5676 wrote to memory of 2520	5676	msedgewebview2.exe	99
PID 5676 wrote to memory of 3872	5676	msedgewebview2.exe	100
PID 5676 wrote to memory of 3872	5676	msedgewebview2.exe	100
PID 5676 wrote to memory of 996	5676	msedgewebview2.exe	101
PID 5676 wrote to memory of 996	5676	msedgewebview2.exe	101
PID 5676 wrote to memory of 996	5676	msedgewebview2.exe	101
PID 5676 wrote to memory of 4748	5676	msedgewebview2.exe	107
PID 5676 wrote to memory of 4748	5676	msedgewebview2.exe	107
PID 5676 wrote to memory of 5900	5676	msedgewebview2.exe	108
PID 5676 wrote to memory of 5900	5676	msedgewebview2.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC7F349E26BE2E22CD4589027EB8E1DF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9052678FB9C7649036514DA04B3CD1AF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B2421A355F121104C6A46B3CDC722AFB
  2⤵
  - Loads dropped DLL
  PID:5196
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0890E9F8CFBC7AD2A7ECFCB8A0BE9203 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1E501F8E0671CB256F7C57933FE4A97 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:5248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2672

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:5936

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=5964.5616.17548650925137776752
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff8397cb078,0x7ff8397cb084,0x7ff8397cb090
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2276,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3984,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=137.0.1.2638 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,6424310869951521180,9225982840911009243,262144 --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:14
    3⤵
    PID:5900

C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys
"C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys"
1⤵
- Executes dropped EXE
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.6MB
SHA256 043e363ac3ed11ca47a21876b70b8da384f90dc8d71a805bc52efa3263227268
MD5 8cc74d6f70e7d6c958c7e20a8e7f21e3
SHA1 a9336696d6f45b7ed37057cc765d8b9adc8166db
SHA512 285ad2dc391c1255213fb2e4d434df8e13b68be072d3bd41a99758d13455c00c80a72999ed8ec6d1b21e35fe132de2607ada5027015888f4af5b2debc13969b6
SSDEEP 24576:m+uojr0cIAigVc5xIJaWExsIkiKRyfSqG8d6+BctEmpG7urKpsPVaN:Lfr5IVgVqIY9xD+ASqGK6+2tkPpQEN
TLSH
T104755B57B6B540A8D1A6C038C5276707EAB1348A0B709BEF15E08B6A7F13BF19D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 39KB
SHA256 6d6f727f3d0dd137cf09107ef1d3155ada62fae5e1e725d44a65ae85c36012dd
MD5 c01f3e105ccddb13bae143a2e4d88843
SHA1 17cb9dfb3d7504f67717cd5fb3b3b3415c5a97ab
SHA512 a91f470ec1afa45fc75b83ff2d94c74f0248dd72d644c560110691d98974440f2a2efd800ca2e25aad8ddbf8077b7b3140f9fd55fac80ca3def9048f1c1e3e12
SSDEEP 384:SWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/TjX:nwJTwYB4E5n/xe5arvur2R1dbTV+wh
TLSH
T10A032B0296BD8323DA995E34FDD0B8516BFCF7C379EAD60F500AD1E648863819A90D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api
Size 173KB
SHA256 3c8501465e2549e0fcd70c7997abd4c05f62a2e71561d8a587f9f50082d7e686
MD5 2b30259ced367088a32148607b8b2f1d
SHA1 b19ea3853c63e12b387e9005ea3391ae59856218
SHA512 d1b209b30672388eb3309c2fa155b258a376d2cf4a8daa3121cc241df64dd74ff0d29a4b3ece7e3c89e0c698c02d270c1d6f9dde8667b9d75412a8fb70a8ec77
SSDEEP 3072:ISE8zEmbyhtVsBUCsXLyBXBlieZXFN1DYNkgwk:ISE8nsXLQliiXFN56kgZ
TLSH
T1AA04E84BB36900F6D1BBC038CA975A17FDB238958774A3CF86514B661B137E0AA3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat32.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api
Size 91KB
SHA256 875d74cf06d0040038cf15e0c312a9921522573021f16dd419b5263679fcd019
MD5 7ebed667f8eaa6378d1b7fa98135674d
SHA1 a49d0f020ddcd3c5460401d7cf7e4d206e8c4937
SHA512 f76a2f719ac8d7e38d6c16a23b5262e3573d92965b276cdecc462d6804092e4c99a6afbd1ac5b498656fb4bce3e2b63b2abd06ad2c0c5728d2217ebac9d53a59
SSDEEP 1536:01LkqyqGWOGraAW3UkQUSJbfT3dHZtLhLmHYv/2WuJM1ywmhUN:01IHqGWObAKSNfDdZaYX2dzwHN
TLSH
T19B934B31B54CC032F9DB09BA9E7D859E9638B9610FE514CBF3882A4E0DA52D27F31527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 35KB
SHA256 46c76a0e911d24bcb0a8f01b55cf53014d8c92be6a3b3ec38890eedb5a1f9d83
MD5 07a1608e9f93835ac29be2156215f48c
SHA1 028cf9800f42eb36f1be465f8e5988f231d79b24
SHA512 f82e37e1ece6d61fd1e36de6d95870839c1de4515b5e5690396a8fcd309b1e45dfc4cf4293a67dbecda4d36064ba26db0c51c8cba8ddeb6d080c72ff36969f4b
SSDEEP 384:yP9CzFCCA5iirDlmz/3blTAY9I0VGWUhxciqY9OGc/uo6ki2Ki1uO8WTfNLbcrW1:uCpCxii1mrLmpx2Wtr2R1uWTV+wH
TLSH
T105F25C5756BC4113EFCB0FB9A8F2BA110978FAC669F7D60F841690AA1D033C05B54B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 6b9e56f7a9e4dfb0d29a808d6026180013bb96ab8015f3d5f1c0ff675657f821
MD5 0f0c266d546cbbcf77afca941fd7bbc8
SHA1 6d7813b3abaf6eb9c6026050e3512bbc9a2c8fc2
SHA512 022b1aa81c309ab17518bb626d66d5ecf9212214b1391ce22e927638e5a7ae993ec3650717f0fea06800308500f35981ec50543c67e34c2b43a3ea3a4a1c7750
SSDEEP 384:lyw5tUebz1qErhM5Q92rbYQujSQxrRjfU6ka03S:kw5tUebz1qErhM5Q92fYQKSQxrRrFk3S
TLSH
T1F5529622C4E4EE725B1712F17EE55C210B9E5323969D1086F8AD698FCF0C9D60B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 c5c3c51a227df1e6e50aac1e9f0b48d4b12c863869fe77f7023157b95dae344e
MD5 38a3c222a19cb351a5c4ad93a9399fa2
SHA1 aea79e926f41ce9ab8f5969171a6e05919257e1c
SHA512 10b0f66a2ad5e346fee3f8522aea1a767418408c836cd13c903c20dc8392b6babf2d20aaccc6df361c4aab81f349daa0957a622b234f0933ff9c9fed3fac84ae
SSDEEP 96:0WLwO9ZcA1BHKMqPkDDCIXmOwE1aWE6LW7ABIm6Ef+gbBDA:f3D+H7AD6KJA
TLSH
T128C1B8EDC6C8EC02F301F570BAF29913258537B341ED40D9AEA69C9E9B488D9C5513EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 33KB
SHA256 f3165d6942e2786b46680a1d9b2d3e3c537c95efd407077393fccec3acc79680
MD5 6c92e538b85b4504c4887de1ac3a594b
SHA1 4099e1e16bd4e0b2d8d11f3079016b27f387e86e
SHA512 9e98b372dfcb43f9c205509b772cf155b2ce8a8ca38cba7441e7afc02c3e2854db28b06e10206812e0e2ab93e9babccd94aeacf265190e6b03d2717adb41a739
SSDEEP 384:P5Vb2YAc/LlrdOrzK4CZnWJfpqFUaCtywJfp16fTSYj1XFRW1uoZg2dc/uo6ki24:BAYAoE2ekSlrCahtr2R1D+zTV+wT
TLSH
T113F25D93E75C4213DE8F4BF5ACE5DA110DB8E5856EE7DC0BA409A15D29123C02B78B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 b8be8e96750af5a350ee6a3d1bd5d6cb44bfa69a2b633abfd8f5e89efdbee420
MD5 0bdd7b1adea78df999d5c68163089d83
SHA1 45846fb54ef29ae7c16dad67ca893a0d638053e5
SHA512 b93eb194ec2ede028150678a329a6166c624fbf35c1aa6db93c607409603727ae1e6e16b32a85bce9dee28afc9476b571c0e48b79e2fda654f766b190bfc2c72
SSDEEP 384:dyw5tUebz1qErM5Q92rbYQujSQxrjfZZkEeH6r:cw5tUebz1qErM5Q92fYQKSQxrr/xeH8
TLSH
T126528522C4E4EE719B1712F17DE158210BDE5323998D1186F9AD6E8FCF0C9D24A872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 90d2b5b491d2f5a7f810cdd8b686fb14172a1c686c75d7bf87e7620e485072e7
MD5 339608f1146ef09168071a9b63d3d6de
SHA1 ec66bded2bee5313b8746dfe0946a8f7d1904768
SHA512 3e4ea06015e42fbb7b58c53a630527ed7fe5bb23fb35ced5736749eea00dcecc809a45431006bc11aaff8fe578aedc2b4df3d1e0fd559227f03f9a92a1ede7e7
SSDEEP 96:0WLwO9ZcU5HKmPk4oV/zZ3q1mOdtN4aWEZgNhdmSElOD2bBDA:fkvVMJBgNqStDkA
TLSH
T15BC1879DC9C8EC02F204E570B5F2D503268A77B340EC42D9BEBA4D9E9F44AD5D5123BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 33KB
SHA256 a6fcfc7a626346b8ccce4a9bba781def27f1a4fdf30f0a337f4ae95c60820580
MD5 cce65c06a59cfc195982468eed3ddb06
SHA1 84a4e5468aaad67fc663b638e43d462dad279ffc
SHA512 db2fb0814375ac7e516990c950059ad0c1412ab02059faebee943c110281dc2ea88a0b05cc2239c9f70313fac489b797016148f3db3a3d501f2edc881b4f71fe
SSDEEP 384:o0fy+7uHt+/qH2ilyYiii1JUpqqLJcTvgfRh0e3XgYie9Cz/uo6ki2Ki1uVbTfNG:f6T8G2rYiH1WpTiU9knar2R1MTV+wUp
TLSH
T1F1E26D8797BC4313DB8B5B7AB8E4A5114E74FA865DE7D50F9017E06D1D027802B60B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 09772571a4ac2f84ac5155910c349370fe663a61a315f3414c58288c6b062161
MD5 e8e602772ab6f5c002ed24e9e8bf879f
SHA1 4f8b0c986a98bd53d25789d73172bfbb10450a9d
SHA512 bd7ac26bc77207d0b778957c77f88ca91f14daa78d5420074fae6c6aaa329a59ce134627d405d835e8e143496a55cb20914cc66d141d42d0e5c110f2d213d0be
SSDEEP 384:Kyw5tUebz1qErMm5Q92rbYQujSQxrjf+tklVArvg:Bw5tUebz1qErMm5Q92fYQKSQxrrgYmDg
TLSH
T17E529522C0E4FE719B1752F17DE558210B9E5323969D104AF9AD6A8FCF0C9D247832B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto
Size 5KB
SHA256 2b9d6e71e2bfaa45e9f7f82934a1ca44716d746bee68c3ff142071f1c30f43df
MD5 07a801433f18e38a5b83dc74919d4872
SHA1 6f4a498824217f43415819f60eb864ed6fc186ea
SHA512 0e29c5eb24c4f4562af65b6c18c6751ea9b8e0736693e070c29a7315c5e33685d60427fe2d19364431708a1ae0234e433ea9f50212ce360f2b8648511d581174
SSDEEP 96:0WLwO9ZcS4HKaPkSrnSbKmOAeaWEveMOSbKMmWEiSb3vxbBDA:fVSrgPeo2WQ3vHA
TLSH
T1DFC1959DC5D8E842E300FA707EF3D4032589277344FD8088AEB94E5E9F48DD4C6513A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.2MB
SHA256 10bf5b106de60afde0b21772faee3c8dd61de75d8943b2cd325658b1fc36699e
MD5 a2868a966a4ce7b03fc118cab0071022
SHA1 6489c437dfe6538907ae1d656e62a71cf8829a7e
SHA512 e82fc5f292a4ee17ee8ecbe51a56bf56236ba5f8a28626372441f88bb0295211de03e0c17bfc9fca16e42eef0e2d46de05346e1d054a1f145d3a01b659479031
SSDEEP 196608:5fAMRENS1dwsnBxFg59m8HnMX+I804UtBRdQePw/seRsVj:hENS1dwsn16EmnMX+I804UtBfQWxR
TLSH
T12AF68E6A76A800D8D0BAD0BCCA5B5713E7B2B845037557DF17A096BA1F37AE44E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 217KB
SHA256 f9d0a937cb71a55031cf4863a5f4d0006d87bf3b21c6cc730764a32edcb7061f
MD5 a1d016fcd61b87425e4c5e1198b3cd32
SHA1 a4a81a8d3d1c78626529334ac17c19872d89892c
SHA512 641df91928f69cfc7e5c4d0b6b1c80b492393d8315d12bf6301ea7916c614cb897901443062e242e62df9b752b24692bb85d834e84b74af5cceabd89419ba41d
SSDEEP 3072:jW95t4/CbZ8Mqatj5kDI6E3bhjKPIa6vvpm2DQwrHF+ibXDzukibw0y:KDW/CeOeP3K9ZnuHbA
TLSH
T137242863B26800B9DC67823485A75A01BBB6F8450770ABEF07594A7E5F2B7E0DD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 175KB
SHA256 b0b9df44e285386d3475bb722eb2bfa3dcf9273da3fc2613681673f4394c684e
MD5 b2fdeb8e2c137e9842297924052ae87c
SHA1 484eff5a5b5c9821fb82323fdd15c0b687307eb9
SHA512 3888416963889c2e4be5f7c6dce1970abc0afd18e1048345a7cc9c3ae8a3a497aca7b1c89b762d334873c756b95b8a7986b08ca1c26337c9163ee463791da91e
SSDEEP 3072:G9p1tpsZpdP9RvOBtnv7ZDqR7LtamqX0abIV1AfMqUG9qwU+:G9pXpsB6jvdD5mwYOMqUG9qG
TLSH
T1A1046C0273519171DBAF45B41D789A739B7EAB20CBF158D733845EBE4E203C9AE30A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 83KB
SHA256 bcfc09061e5039d6661f16181dd6776ed85d89839a7d6aae7a04450cb41c5bfc
MD5 5500fd92fb430b17168a7412ee897106
SHA1 6c24a9c784f656a01e24dceb139dfbf8e4d404db
SHA512 ad7902d8dea337b3f72ca8d70f18072e136db29f852227b00aaa5da0128071c69a08e486c468243ac9271f47199c391fcf1124d15b3cf7cf6dda9285a63806fc
SSDEEP 1536:hGT7rg4dKKVidHmQcJxKmDj333Xu2GM1BOfw26yzK:h+jKKVocJxbLGBwcu
TLSH
T1E483F6F2226C44A5CE968634C1A7DC22BBB1FDCD172147DF02C6899C7E92BD15EB861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 71KB
SHA256 c5d0a255c4de23a5a299669f188276b5296bbea54871d74f9bfbfccf220dc583
MD5 cc6cbcc77ed8c1780bd7751cbd4bd397
SHA1 0fa7e2de10aa75c7a436c961e444dee988315cb8
SHA512 962b77914e598ce53617f26884c6a7719074e3e465d92b615e14e81cb616472f101339ebd9c8a1003b2a03bb131690014866ecb027515323e5fd233355fa776f
SSDEEP 1536:7GJNmwl5UCVTaA3NgIFV5kdM14Ww8RSJMzw1T:iJNmwlCA3NbFTCDWw8gJMU
TLSH
T143733ADE990003B2D9DEA9FBB3AF6733356E675007F510D7A14A49A5080D3EA7E38706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlp.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll
Size 850KB
SHA256 e3ad205b1462da42039d10578ed13615dc614a6c51a3221bf5b468a753648861
MD5 994c46d6c84628b4ed9739653e3f2126
SHA1 b0461935844d8ee45cb146076d555af854d86b18
SHA512 95858566368d65c4987f5ba98f22843b7a1a37e35096d8f97f917217e9fadcbbf4010fbb14104aeb5361dd3a655f2c20e76fe645672bd5b39507056d4743183d
SSDEEP 12288:7AMU6+GxzVk6Dar4e9oMQhsEo95buRPgHCB1NlXM:7AMN+G9OzoMzbuRPJTVM
TLSH
T163055C3BA66C52B8F0B7A1B892EB5911F775BC1623A055CF436049793FA7FB41A39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll
Size 698KB
SHA256 88e7e623664066a149a1d206d4bcd08195094078a9246459d2699cf819ec87a5
MD5 3a3378a37bbcde831a0952cf0006e5fd
SHA1 8442fbd5505554131eaefcf3d833b9666add169b
SHA512 19927e8473af7b3add0a6cacb11d07fa7853f6e1eb29e7bc40a8823ffbe7259d269b6f9f80a2737904554ac99d7637585cb9b5553b49769bff80d7471a9d1046
SSDEEP 12288:YXVkoEspfLTN37IqXP9Vo9/LTopq6lpUs5PQct2S416Or4ZEB:YXFEsBl7IqXP09/LTopl7D6ct2SW6OkY
TLSH
T1C2E47C3272928075F8DE57F12559EF7666BC29322B7204DB87D0AF7A4A309C09739F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.2MB
SHA256 c2b26f9ab549362ebd69d1991c6395ecc380fcd36a6720d2abdd51998b513bb5
MD5 7f0370c45312a999afa5fc68a9b58a59
SHA1 f3d59c4b0983de4918c6c72b398a07144d8450b8
SHA512 ac833aed95ecfb5755e804717746753df8d75dacfd284eba331051a2922f85695bc027813c584881c1d657a11ad19e193a6a5962634bc690d4dc93fefc3866c2
SSDEEP 12288:sIRpVQ9ALn2ggBHvbfeN/LD6V5l8QG8mcigIgqbGtphBMmOayJH4OTcculDw:syDQ8gxj2NzA7abGtphB/OBH4OMlDw
TLSH
T14455E961376B2F23D65633B9FBD31EA1A3346C463759730271DBA0110AEA24CB2E79D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.2MB
SHA256 a059ea151d9c2b069632e83670ed23946649a9e3e7d75882be419586b6c61b83
MD5 4e1096c526f3aa59474911d082600f73
SHA1 f0143115df95503668e79903aa939f4db2953928
SHA512 bde893a4de2bf8bf0d680a38f783a791cefb456e242b9080787a937b9af7062efb79ee710d73cc6057804f7189478c0c2df5d239a055e83b6d9983560550df92
SSDEEP 49152:PGtlqni1VwASOt1vwHhuJ/q9uQ6HazSRWGv3dg+sfeGo+ohnzgpXz30+Knjw1Q0z:UuHoC5Qqeaohg5z32qJg0rVT+ir
TLSH
T1FD469E69A67C00D5D4BAC1B9C2865227E772B41557F05BCF1AA086FA1F23AD01FBF780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 3KB
SHA256 e79d4ba3ae6037f9aca03d3c9474ebd5891bcc1dc1257b5ead90e325035293b8
MD5 f79721c6eb2d882b9c778e16296b8149
SHA1 deb536573ffe839aa2234238c7240987b924df55
SHA512 719a298563ffd47f3a64b480d5d15c20bf23b9aaf325dcca1b99e389d36131db3c9eac081f5d75b722292a6b4379f9f9843daffbcc657cf5b782da285d08cca7
TLSH
T10661EE58A7A24A78E98B33607F133883B7657080E0F8244177EC9189D3D2D5EC5B1BFA
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 238KB
SHA256 86f5c40d332bc04b01f5ed4ae4d8a5a3445e5069c471a186234b6585a971d97d
MD5 c308baa10ddac9f78f174d42e119c9b5
SHA1 72e0a272123abb990201841a172dc8d0f6032125
SHA512 374e1790923d7f2b3324faac8952547c3b9348f6df9f5fec9cdcb2aea191ed1c7034826b12c1e167a9806f98f59bd083c21a2da31ad7f200b2b3a27e8d75b421
SSDEEP 6144:EbILqAXNojigKhI0uFpbuvHahWLSFTbejfHy:EbelXuVKp1L5+
TLSH
T188349D16A39509F4EAA78274D9B2C613DAF2B8452322C2DF039486581F37FD0F97DB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 78KB
SHA256 5c5b7f15ec998e9d4c64b831075ecf928e31ee3864f959642e8487c5d6da7281
MD5 2f682a669eb07e0df9f094d78936d5e9
SHA1 55b19c5c8042a3f05224bfad78451b88d50ac600
SHA512 e8cb99e68e0bb8bfae178983d34595eb30cabc36cebc86749fa7e18a24f8a36268c988d637a18ffa34358d541c1a5a1e4311002bcf47d623d919d7b36f1a8a06
SSDEEP 1536:o1Yv0H2UZyO3gHTnxAnKa7cV0FHZL1iCYpM1Ow70vzB:cPEO30nxAnKa7cV0FHZL1iCYpDwat
TLSH
T13673F56262A40CAECD1192348CA79C12BA79F54927E146DF024E79ACCDD77E07F3C629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 68KB
SHA256 77a4d156ad9e0013f874eb84257068ef8bd170b5f020a9ef087b51ba71440db3
MD5 8b166236b367ae4802b38fcd3d4d1e3b
SHA1 159386a271cdf398b7997758fc28066d9eec061c
SHA512 cd3e2373248b5d94514be1fa25f42c6cf763270eb535b75a164b5030c90872fad77c53867c175f96c6259e09bfc2869bce0bcd3e900477cda26311256ef1638c
SSDEEP 1536:NCohO6pg3Kq7slCFHZL1g3JkzM1YwRFz5:26pg3Kq7slCFHZL1g5o5wT9
TLSH
T1CF633AC2BA1801B3EEEC5C71B6AC35229D695A101BF684F36D593A888C07BDD7E34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 2KB
SHA256 0e3c1ccf15ae33c3d29a7809157093cf4d47a721d9f35d7941a5ebfa10db30da
MD5 c564860b7bfe1d0510322b5666ce7376
SHA1 9a390a527d89466aec93d76cd615110eeccc8171
SHA512 d441458f99227efce7a6156764ea00dc2b7790ededd2545d3c24fb484bd6a07a43f5167b559c4e08129a11940e413ebf11f794dc7184164a8d8a6a417436c1fb
TLSH
T1B8513736BBC1187C7C85A340AC176A3318ECDFA87A77152063A4DE404CDAD6BC697DB9
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 19KB
SHA256 135556e33cdd560a972d0e7b7c955de8af476d85ea6f9faa4f9796a64b5698ab
MD5 09fd2cf7be43c2992cbe337cb8648262
SHA1 da0f873254352afce2e7ba97be1a0e453cf7cd76
SHA512 19a246ba5b92b3e7a1962739cffe1ff206494b063cabdfd37ce7a49d92cddebedf948ddc328b7057cf0cc0df30103507eefe51589b847b7141ede66e9a3eeef3
SSDEEP 192:4o9njObGKpsxI7zgPwXWS6ntDCuPhEalclblel7lml5iTw7oDw9wBkBIQstuL1TO:jKRcxUj5yphMyznwc
TLSH
T19E922384FB8AC67C3D5023D19F169FA619E4AD08B2A71A73F7418F0C49C181FF649EA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 1KB
SHA256 0a703e26cf30c928c7489722df39b11b3e60e976c6e2ae9d3a97717957952fd4
MD5 f2e5cec2af5b6bf728aa060682993ab2
SHA1 6ff78eb20e20037293de72506ddd7eae57ce943e
SHA512 ac437f56d6d96d22f9fe83fa5b5f8ed3c9af01314ae97ebae29ee9c7a4eb332e0b1f971a483e064e3fd1fef56aa6545e7e4ea8e0a992c890cfcad28113ddd80e
TLSH
T15931FA4B121E3D4ABBC78E285CC679106D3994E029EC6922257781BDBA503E21BF941F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 00dbc5e57acc52429ab7748f90f145f9c2527fad0771a95fdb0ead6b78f88ea3
MD5 24f56f59afe85fee2d964e4506f7771d
SHA1 ff60d065cdd5987b5840b9583e2f32a5b6bff041
SHA512 835800a5386be5302265fbf0db5b249250e0cd58c09f82f3262924de475ed4ffdf3cb6a3b7063254bef708198a1d0925a58efb3577918a33c599b0366f516e5b
TLSH
T18931FA3B0F3D5911CE124DA426C9FAB61971C9D12DDF207A31289A1B2881BF64F15D0F
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 48665372e0b984e9235f3c78d37abc73c95fac62a02f05d89e1328fc3ed66480
MD5 02d9307e27dbe554133683017ae2e916
SHA1 26ab6ae51f6e5cf1b7f1d866fb136e19baec030d
SHA512 4700a3db2f5a8292d105e50201df01b8665a53791b82276c38cb0e0eb6cea51bcb6dcb5648e1940885c71b7f6fe8cbc5ae897158ffdb41fa3cc02a194c8d2310
TLSH
T13621944B56FE4C863A154D950DDCE2F67CA796D550CC284AE20BC27968103861E5202C
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 540B
SHA256 8735e3cea6984cc94f48f21616a02f1de92b9a40f3b844c298b35d57c0c58ab0
MD5 93d8dc0fd7867f92a4f929a0219c8b45
SHA1 d65ad7075f1b13e8e0cbc12c60b8907b41cc7794
SHA512 520b1fbd4c144bcb9c6efbfa3bf1798bdfda42e8feb8bf419e6a2c1a80becfe7cdb634f3c2ef54eb5cbd5c2e0f5515588a4a321bcdfaa74c67b005376dac0c1a
TLSH
T1F9F0593811F9801EF03ADD3447E1A6969D25FE121821664D19A80308BF21F406C93B76
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 88ea26b5e5016d057fd02bc5a802b68d6be427eae4f32e3e5fa85111dbf495d4
MD5 4943009dc46e49f6f0dd3e5681ed63ab
SHA1 2f04c811396f1625a1399f5ede411377315b6584
SHA512 3e88eea8bfa6a9819bd23ad55aa435d61a62840d207dc55284c71a3c68a42c365b736d2b83570b617afb81933e52760f4f8e699e0cf7cbd4c799bd4442946241
TLSH
T13DF09E2409F1821DF077DB7A0AC55567F616FD023C20962502624B1B6962B408F2747D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 0b5360dbb2ade2fbe618aed56c7540021023d6cb0ef7ca0c3fd160970dbdfbf4
MD5 a8c12f5ac08c77dd89b237365c76797d
SHA1 7a505e4ecb5ad5bed02efc32a4ac2bb3aeb8e1e9
SHA512 79110f04f50ba492ac8b14f3dc1b831707d613d85f051785c5040fdb9e2b2970598fb7cdefb5af4f9c1f6746f1ab0e7c0bbf2eb13d2a82ae77ef4677d4738f7f
TLSH
T12DF05C1425F4901DF633CF3859D46AFABA9EB603392406BD167547057B21F405D13538
MD5 SHA1 SHA512 TLSH

Submit Download

MSICCB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICCB1.tmp
Size 5.4MB
SHA256 5a14eba49f4a5c3df14a26a39ae9bf1416759cd9cffd668943ad88c1a7546e9d
MD5 5885b6106ba4aba80086079e83f56496
SHA1 1c7c0272766bda867d8bc85f103d01cb51e3c398
SHA512 f38d82efaecc314449b26c4dc661161cb5ebf7edf54f7b1d422590946859904d113beabd920c70e922bd7d9728d6f608023a7eee98d88895285374ac09896782
SSDEEP 98304:4y2HkVo0JkjFwS6tQ8/xmCnZ98gxBJzemi4YyPkZiVD:4jkVo0yjCmCQ4vPkYJ
TLSH
T1AD46AF22BA01C071D59D02B125BEAB7A892D6C34973445C7B7C02F79D9211E37F3AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 79f33cf746a8f52fa3033a3f01cd04cb036d2471d070fdbc091d48b9188827e2
MD5 06b0cbbe39f4e7da39b8284ae9af2168
SHA1 58850ac12ce5e7197d386dbe869bcf33885ec3f1
SHA512 3b6e3dc8c917e1da5be3153f616b7be9942fe3a2385e3e3ec2ff74e3bba6cf8aaa25718f1198deb088b9e118ed1be8daa6296108197f567eab5e37cf28af1c8d
TLSH
T1D6D0122376034538C02021B30043F1480544EA0B40098100542CC53D1E14450B903441
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences
Size 6KB
SHA256 bda3aec853bcebde5525edb01d52088b2b21d8c97bd776b39707555097f76a70
MD5 03643c735311b071fc98060d86ebbe92
SHA1 0c752ca043e31218ce7f8920edddce09588e536b
SHA512 c3b42d4ab69c40a40d379b53da60fb6da6e6b6b249d628c8d5e796949fcd2bd325a487cd93c777731bcebe4a0b29998ee11641d907d67ef752ae558571a5a9d0
SSDEEP 96:stq05UbWdb9iffnZ8i0v25Erklm/7qx+WVHMSm+uecadQjP+gRjCMOYL:stq06Ff/Z8pTR/S+Wi8dqzjCM3
TLSH
T1E4D1B8135E6869778CC7F219BA357F02E3F9602265D50E59EBFC860C09E65CD630B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59da97.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Preferences~RFe59da97.TMP
Size 6KB
SHA256 910ae90848e9e0a7b4565c27b8ad62416088c1b2a27491545c1f2223f4f6f555
MD5 f63f9bbe0134facbbe6890d078e8c412
SHA1 a6c33d51ec7a07ed43bf6e1fe79dc32b431211b9
SHA512 0a7aff70a83578c3374af605e1c3bfb982f0b593c62b6988d41492968d26eac8307c1a7234efa0e695ecf27cbdf71869233ee9d31577dc2140eb54aa79f655c3
SSDEEP 96:stq05UbWdb9+ffnZ8i0625Erklm/7qx+WVHMSm+uecadQjP+gSjCMEYL:stq06xf/Z8pOR/S+Wi8dqgjCMF
TLSH
T123D1B9035F2869778CC7E219BA35BB02D2F9602261D41E59EBFC860C08D65DC230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 2KB
SHA256 fa775158d150b61e69fe404e5c13b9b4eb2e014068a4887138d08ce6ca378d3b
MD5 3244496bdd0bffc79c9b965a4842e028
SHA1 4f8fb1134552a2f235aac05bae4eb08846d42f33
SHA512 67f184eb91e888341848e8285c570ca8016455173ed37c5a05f512c89bef470bceb346dcb4d2bb32af69eb73fd3a3a1815f58059a31d75f8eb4122ecc7acb5a1
TLSH
T16C51B8B3795C6A778EE29644B98A6F27AF31906B96512F9295ED0F0C00DB55C3302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 4d937224963190091dbc085a4a6c4942222289143c891c709f69a2486b4aa527
MD5 eac752ad3f6586f7790ea7335cf5c1c6
SHA1 382995a8e37e614e0fde9d4c1bead0b2c60db307
SHA512 39e5b8465aeb7092d5e42caf1661ddd7da3fa08f0d6db38e33e12119c453897fe326251fbf469f2383c1196f93a5c80075e31c0970a90230087053c0ee121c0a
TLSH
T1B781A7736568A5774EE2D645B98A2B077BB1902BD5813FD6CAEC0F0C01DB29C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 1KB
SHA256 bd7486b94743ffbd9f34fa9d9a1621f10ccb09c60600dabdb4cec20637c4075e
MD5 3ec98ef065719426345bc19ced803729
SHA1 90f0258fd7aeda6910d917dc3e92144c08215281
SHA512 6fa27ea232b7ef54ea62579bbd3d45d04ba16a38895254ab8e3cb86ab5c8bb309b8844ebb2ac561bb412c30f662b77ab22321345b2da42c61f149bd35904a141
TLSH
T17E31A7F394AC3B776ED15641B187AA9B6E31502FC2019F8592ED4F0C01D748CB62AD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 14KB
SHA256 ad21edc8f4579e9a1e1e48652304a0541faceae7cd324369521d934013702c3e
MD5 c95ed71b0205d4f3a84281b05fbac94f
SHA1 748abd2e5e7388138e4e8135a86c458ad4a7f572
SHA512 ea384d5b59bf863bfd8b5889bb28332a595a34b3ff3b055dc7c432864e32eaad5cbc9de2ef84f04d3381ea62f8b896a90bdc078d3e18ace39b791b7245db924c
SSDEEP 384:zZvsrvyOiyp4+IWA1eUVWGfvvLhNbfAAnY6Mk14C:N0raxyp4sQe6WGfvoKY+F
TLSH
T1BA62AF711B78553B8DE1E98B7C8B3A1B7FA5992BDAC12FC4A5E0AF0E044B18C1706D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 6caf7c6224243b5452ddf067305e1509b51aa24e11b8d1dfa066c592b59614c2
MD5 4f45506564990f7f2fe2c670d243e076
SHA1 e44fc981e7b2e3415abd4e1108c5164a83e992da
SHA512 4122121e0148658085280b8b49ba4a198457216f6eb8d9748d6918ea25219330923bb5c58c7cf7f5580ffe3841379da92c49ed937072d06fecddc501b8e7d92e
TLSH
T194718673696CA53B4EE29A44B8C62B17BBB1912BD5813F96C5EC0F0C01D769C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593be6.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State~RFe593be6.TMP
Size 1KB
SHA256 18e7dc96de198147b8ac1cd428dce308a21ee978cf21352e33e64870b06ae2a9
MD5 fd9381cb965bcc6c247206146a5710be
SHA1 ef38b36a0fe73b914e17dbeb71d1b8d0dd6b5c3c
SHA512 1ad55cafcd403fb1d82deaa0175d35a9d3d5fdb84de7126d43202d1c29a82cd8a17a0280b817987205993a3cd8018471674127db7bdc0ba53fe21b46c9fa0d32
TLSH
T1812162B3949C3A77BAD04541B253AB8B2E70506F82009F4A92ED0F0C05DB89CA726C33
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 788B
SHA256 354cc291e8b832db338704983421a86cf2b57a0fc435e8b38cc5860d0ee721f6
MD5 3a696d0707c6e467ac71b7db54cdaf78
SHA1 70bb40ec27bb68ad913b2da44c7bb8b3ce0ca309
SHA512 aadfe365f58b2efc1dc83e37939520d977c114b4eaddebb4c6b795fd74301c15c9e9753a58dea0b08b72d4ba6bf911e3a76b02e29715f4d65bbc7e0f9d7c0719
TLSH
T114012612071809FF45161DD3DF8D6D2E6B91564C729FC53AB26D6D0C3F08010AA6EDE8
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 9KB
SHA256 ba6c9f374e3d7afaeefee273bb39552a368e422a6f9610d1d4262a9b705f3579
MD5 81b404ab66f68d2491f96e339bb843f1
SHA1 94ce5eaf030dc8cc800e9e0b61d7acd34d3d9f4d
SHA512 ae125f9252e17b7fe8c1286b72bd6d1cd61b2aad3984afc2c3dee7282a25fecb080c927d72bd505330a5981ae3fa43513fbcff416dd4ee3a7fee6ffe684f7011
SSDEEP 96:TnyDxVMDb5gGgwh1Ox0QhHaARIDYW3fAafT1Pyucr3mkgaaZ8oas8uaBTad6y0Tc:D/w4SaVZ8vs8hB+dsKNezPiNkENjxjMw
TLSH
T1C1229712172405AB83540EDBDF8D4A2F5DAA6A0C339ED55EB37C998C7F080109B2ADFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 de5928be247c4f2b4ef1da835aee31e5391eaee3ce1183f8637609ba3b7a750f
MD5 e4fdd13a39e41b56aedf6e3ad5ccb139
SHA1 e81a1ce20553b2b507b867aad793c285084d4a5f
SHA512 7128ec0914a102da73989a5840a0815e86ebec7337c7ac3202ef01953cb60bef22200a05856d74955402a3326a5c79d4b5b827ad92430d776c6f4b5b9a00c0d3
TLSH
T17E716D31470765BF37133ECACF9B9C2CCAD29D05638A1225779EA60E7748144AC2F9A7
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 48f7deb135fa2eab3ee8814ca869e0f8e64b1098e3063dac9c1f02027ef7bb0c
MD5 944cc769bc9ff1b7ab9c91062f619643
SHA1 913adb2babd3243a9bb131ede059dddba48d8eb2
SHA512 de78e4a3bb9a1b4122520489993be4b7496659cee7377c5d6a3733af086afd9039ec65da968a906664eaf1c03876a9cd0df49c2b6e8e582300e3a18a354a8b01
TLSH
T140816C31470765BF37133ECACF9B982CCAD29D05638A1225779EA60E7748144AC2F9A7
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 12KB
SHA256 4994e5db5977e96f2796b78b9c05be4a5a26a2e4d0cea67a53e476846f3ccfde
MD5 68fb5af776a28d57885e8c92d86cbd9d
SHA1 a03c1ec5b098605bbaff4033058dee84d63f52b4
SHA512 4db15f5aa99008b28e3e39507d82a4f6834a87cf7ddb97fe8ec5a1aa8baf6deba4fe276ea57cd586131af8a8c52e7ff26020929f4d6f5aae6a9154bf15aed076
SSDEEP 192:LwNwMYpYh+t3Y0eYg6xGbWdPgNIU9b3bib:Ls0t3deYg6xGbwPgNIU0
TLSH
T16C427C21870765BF33162DCACF9AA83DC9D3E60563CB0229779D9A0E770C041A97F9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI224B.tmp

Path C:\Windows\Installer\MSI224B.tmp
Size 574KB
SHA256 fd57011021e68f8c1203d206c056d8fc2cbd573e25053a6202debadd28468ee7
MD5 a2a5a45c70428d6ce0374814dff70d6a
SHA1 c85308354b9fb91dac5f5a27fd232a9194ccf217
SHA512 70d203ab7dc1732b558b88eb11325bbb3fae145d7447e5be54987296829447edc0fbc3f6f22b4fd25f04a7c9f52b28cc4e7e14677fed709e2361bdfcc9c224a0
SSDEEP 12288:9yEECCI6+immO9k3AFkPHph0lhSMXlUpU3+1:xECCQ9kwmPJh0lhSMXlH36
TLSH
T124C48C16B3E902BCE0ABD27888974A15F77B780503A15ADF03A096632F677D19F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_548691919\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_952504116\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_952504116\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 c295b860a44338a878559833bfb677909bc720d3f61c0cd03a412f7b18167bb1
MD5 fe9c43cc425dfb197afb0c29313f09cf
SHA1 4084240a3eecd27eb00ba986b332799f07ae4ff9
SHA512 bc4b576ba29dbe458c40a944cf3be0f296d2518b5e8cd20bd2c1d273dbf3643d313aa01ef30473426449009043cb4c3ac2d2cc5e67e57a00306702691b1f1d55
SSDEEP 24576:d2gmSp1ndoO/vvTLZmSuBUHq/aJZwY24WWh93JkC7p6ok+mHIZzVrPoVh:r
TLSH
T11947C12436F92250E7F79E3C68F06A238D3A7D5B9C159E8D05461B4E0921FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{af10a9f7-bf9a-4f43-ace2-805a20bacef2}_OnDiskSnapshotProp

Path \??\Volume{a40cd035-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{af10a9f7-bf9a-4f43-ace2-805a20bacef2}_OnDiskSnapshotProp
Size 6KB
SHA256 22a23329a9be92c0ab6fc7657b31b449b99e3d367dcd080282f735d095a2ba32
MD5 822c536211996609aec5aa5be4a8a689
SHA1 bc408f2c989923a5dc565631c0a4d9ee30e03007
SHA512 fd29292cefd45c1e4ea34f8d32c65d1bd07471a3e8d5f459ff574bef1184a1257feb459f0a7979f98c192fc324cf2dfff7139608c2299a890210b9a16629f91b
SSDEEP 96:FD7f4FQRdtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:B7f4Sdnb++ZVm
TLSH
T15CD189085AF54311E2B3AB3129F14557A877B911EF33CB8E0298638E2670A10F975F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-710-0x00007FF858A20000-0x00007FF858A21000-memory.dmp

Download

memory/1220-600-0x00007FF858A20000-0x00007FF858A21000-memory.dmp

Download

memory/5964-1160-0x0000000000E20000-0x0000000001527000-memory.dmp

Download