3a89ce5e8bd0121039198b33bf23144021dd534fdc09d5ea9babf8319f4572a9

Analysis

max time kernel
149s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 37.5MB
Sample260801-ajksdatwax
SHA256 3a89ce5e8bd0121039198b33bf23144021dd534fdc09d5ea9babf8319f4572a9
MD5 afff9c9ac1799f44a036161f7e618b0f
SHA1 fc08413397140ce31c106a00bcffc62807343795
SHA512 a7c945faf57d3b87e0b84fa5ff6d8f699b18dbbee1b611249a7950df9f0d77bc534b32728dd88479afffb19b43a9729787c1a57e758638f4f1c3ad38d4a2798d
SSDEEP 786432:HGe27esGvGjc68MURuW/vIi2weNQAtdAToxMwD:meyD0glURuW/Qi2weNZtdHy4
TLSH
T1A5872312BA42C071C59D11B1E56A97FAC53D6C24C73044DBA7C43EB9B9312E37B3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1732	stAgentUI.exe
4656	stadrv6x64.sys
5052	stadrv6x64.sys

Loads dropped DLL 22 IoCs

pid	Process
1556	MsiExec.exe
3120	MsiExec.exe
3120	MsiExec.exe
3120	MsiExec.exe
3120	MsiExec.exe
3120	MsiExec.exe
3120	MsiExec.exe
2932	MsiExec.exe
2932	MsiExec.exe
3120	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
6000	MsiExec.exe
4372	MsiExec.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
4372	MsiExec.exe
4372	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Netskope\EPDLP\win\Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfiumx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.vsto	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\epdlp_hook_hlpx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp-collect.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nstls.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx64.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp-collect.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp_man.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.dll.manifest	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx32ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\openssl.cnf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfium.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfprinter.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\fips.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\legacy.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx32.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tramp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\arm64\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinter.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_hook_hlp.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.sys	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-fr.json	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a47a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FA8.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{96F1068D-FC8E-467F-9438-160593C919E1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI814F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF38F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a47a9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE42FF6A58EFC603.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8325.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8912.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9404.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6ABAAF51FDC7566.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_653437295\ct_config.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI51CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI541E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8064.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B22.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF720533273531B50E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_653437295\crs.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI5E23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9492.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_653437295\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9328.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1A7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_653437295\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI5CCA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8817.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAB9ADF21121E913.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6012_653437295\kp_pinslist.pb	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3032	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c61f8367-0000-0000-0000-d08302000000}\MaxCapacity = "94852"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c61f8367-0000-0000-0000-d08302000000}\NukeOnDelete = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c61f8367-0000-0000-0000-d08302000000}	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6000	MsiExec.exe
6000	MsiExec.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6012	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3032	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeCreateTokenPrivilege	3032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3032	msiexec.exe
Token: SeLockMemoryPrivilege	3032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3032	msiexec.exe
Token: SeMachineAccountPrivilege	3032	msiexec.exe
Token: SeTcbPrivilege	3032	msiexec.exe
Token: SeSecurityPrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeLoadDriverPrivilege	3032	msiexec.exe
Token: SeSystemProfilePrivilege	3032	msiexec.exe
Token: SeSystemtimePrivilege	3032	msiexec.exe
Token: SeProfSingleProcessPrivilege	3032	msiexec.exe
Token: SeIncBasePriorityPrivilege	3032	msiexec.exe
Token: SeCreatePagefilePrivilege	3032	msiexec.exe
Token: SeCreatePermanentPrivilege	3032	msiexec.exe
Token: SeBackupPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeShutdownPrivilege	3032	msiexec.exe
Token: SeDebugPrivilege	3032	msiexec.exe
Token: SeAuditPrivilege	3032	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3032	msiexec.exe
Token: SeChangeNotifyPrivilege	3032	msiexec.exe
Token: SeRemoteShutdownPrivilege	3032	msiexec.exe
Token: SeUndockPrivilege	3032	msiexec.exe
Token: SeSyncAgentPrivilege	3032	msiexec.exe
Token: SeEnableDelegationPrivilege	3032	msiexec.exe
Token: SeManageVolumePrivilege	3032	msiexec.exe
Token: SeImpersonatePrivilege	3032	msiexec.exe
Token: SeCreateGlobalPrivilege	3032	msiexec.exe
Token: SeCreateTokenPrivilege	3032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3032	msiexec.exe
Token: SeLockMemoryPrivilege	3032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3032	msiexec.exe
Token: SeMachineAccountPrivilege	3032	msiexec.exe
Token: SeTcbPrivilege	3032	msiexec.exe
Token: SeSecurityPrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeLoadDriverPrivilege	3032	msiexec.exe
Token: SeSystemProfilePrivilege	3032	msiexec.exe
Token: SeSystemtimePrivilege	3032	msiexec.exe
Token: SeProfSingleProcessPrivilege	3032	msiexec.exe
Token: SeIncBasePriorityPrivilege	3032	msiexec.exe
Token: SeCreatePagefilePrivilege	3032	msiexec.exe
Token: SeCreatePermanentPrivilege	3032	msiexec.exe
Token: SeBackupPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeShutdownPrivilege	3032	msiexec.exe
Token: SeDebugPrivilege	3032	msiexec.exe
Token: SeAuditPrivilege	3032	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3032	msiexec.exe
Token: SeChangeNotifyPrivilege	3032	msiexec.exe
Token: SeRemoteShutdownPrivilege	3032	msiexec.exe
Token: SeUndockPrivilege	3032	msiexec.exe
Token: SeSyncAgentPrivilege	3032	msiexec.exe
Token: SeEnableDelegationPrivilege	3032	msiexec.exe
Token: SeManageVolumePrivilege	3032	msiexec.exe
Token: SeImpersonatePrivilege	3032	msiexec.exe
Token: SeCreateGlobalPrivilege	3032	msiexec.exe
Token: SeCreateTokenPrivilege	3032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3032	msiexec.exe
Token: SeLockMemoryPrivilege	3032	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3032	msiexec.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
3032	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe
1732	stAgentUI.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3032	msiexec.exe
4820	msiexec.exe
1556	MsiExec.exe
3120	MsiExec.exe
2932	MsiExec.exe
6000	MsiExec.exe
4372	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1556	4820	msiexec.exe	89
PID 4820 wrote to memory of 3068	4820	msiexec.exe	94
PID 4820 wrote to memory of 3120	4820	msiexec.exe	97
PID 4820 wrote to memory of 2932	4820	msiexec.exe	99
PID 4820 wrote to memory of 6000	4820	msiexec.exe	100
PID 4820 wrote to memory of 4372	4820	msiexec.exe	101
PID 1732 wrote to memory of 6012	1732	stAgentUI.exe	106
PID 6012 wrote to memory of 4640	6012	msedgewebview2.exe	107
PID 6012 wrote to memory of 5160	6012	msedgewebview2.exe	108
PID 6012 wrote to memory of 5160	6012	msedgewebview2.exe	108
PID 6012 wrote to memory of 5160	6012	msedgewebview2.exe	108
PID 6012 wrote to memory of 5160	6012	msedgewebview2.exe	108
PID 6012 wrote to memory of 632	6012	msedgewebview2.exe	109
PID 6012 wrote to memory of 1644	6012	msedgewebview2.exe	110
PID 6012 wrote to memory of 1644	6012	msedgewebview2.exe	110
PID 6012 wrote to memory of 1644	6012	msedgewebview2.exe	110
PID 6012 wrote to memory of 1044	6012	msedgewebview2.exe	111
PID 6012 wrote to memory of 1044	6012	msedgewebview2.exe	111
PID 6012 wrote to memory of 1044	6012	msedgewebview2.exe	111
PID 6012 wrote to memory of 1044	6012	msedgewebview2.exe	111
PID 6012 wrote to memory of 1044	6012	msedgewebview2.exe	111
PID 6012 wrote to memory of 5800	6012	msedgewebview2.exe	117
PID 6012 wrote to memory of 5800	6012	msedgewebview2.exe	117
PID 6012 wrote to memory of 5800	6012	msedgewebview2.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E5A35837C7D261E74378BDECE5161757 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3068
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A1A6740AF33E0D9AB8E9B53BA49B1BCE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3120
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CBF9F01F7826F06F614FA4D82411FC60
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2932
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3F3688799ADFE824D8918AE1133B167D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B2B7BB125DD666F413A8B1551FB2A31 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3440

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=1732.2660.17739549081137502569 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x124,0x194,0x7ffc240f5fd8,0x7ffc240f5fe4,0x7ffc240f5ff0
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,9862632570958221726,14298072480989587547,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:2 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1768,i,9862632570958221726,14298072480989587547,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:3 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1768,i,9862632570958221726,14298072480989587547,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3268 --field-trial-handle=1768,i,9862632570958221726,14298072480989587547,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=1768,i,9862632570958221726,14298072480989587547,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:5800

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:4656

C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys
"C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys"
1⤵
- Executes dropped EXE
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.6MB
SHA256 03ac79db9ae599f7c23a39038740f46a6c879a65c079bdeee3acc4bbf34b0237
MD5 a54aae857dcb499693d58a71e9db154c
SHA1 99f0f46c86c6f13ccb436a1dcb851390c3583a61
SHA512 37f3ff6ceded1a72bf2b085c5441b0f28ab188acc14d947d4df84fbfda9b0b44cb56b4bc3bac8d2fb59374aeb6f189a29710d35bfc2889221d3394b97c8d96f2
SSDEEP 24576:sIb7MbT+qGYZtIx3oJm+OfC3OjUXcfLbCi2kwXEW3TW/Qba:sY0T1Gj457czXgXTpW
TLSH
T1D9756B57B6B440A8D1A6C038C5176707FAB1748A0B709BEF12A08B6A7F07BF59D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 39KB
SHA256 f28f6345aa228c1e8250d3fcdefef55c435a54b893daae59d338672d2af6a0c4
MD5 27f5458d2c949011c4f7395ebea2f4c6
SHA1 f844b3cf857c79dda7e253ac45706f529c3cbcd1
SHA512 46efb43dd3864e539f6ba17b6a3b451a91bd9630c010112472e4410c2c6b4191fbe0769bc717ef8d18c1d6fdb3bba12e38a8b5a95a6ed1f882c31c63dc00c19b
SSDEEP 384:qWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/Tjd:fwJTwYB4E5n/xe5arvur2R1dATV+wXC
TLSH
T111032C0296BD8323DA994E34FDD0B9516BFCF7C379EAD60F500AD1A648853819A90D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll
Size 47KB
SHA256 018f5fe2880c5419cda8d2af19cd0aa3c5375ec20378b854fdce63932ef1d997
MD5 475f329e73357d2ec0a76edf181a3f73
SHA1 6762ccc2e6fab8961c48dd5591432126bff3754f
SHA512 d6093f890a770bb4bb1050cf024127c7935faa2c5f8a0fa3f5611ec123b3fd92b192c616abb68395414179557fcaf00c8e4e82c6822c30fee337daf4fcf95e8c
SSDEEP 768:P7vV5z3+6KTqUPtLnPDiQ0fWST41mocNAwkEGjhl2BOBaBnD/4xFsOjMi2jXHU1d:TVs6c3dQ9rHUcE
TLSH
T11D23A681C019F261E80D983435B0FA81F6BEB7D72FE9F64E9212FEF44052359E194E99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api
Size 330KB
SHA256 6e975d70aaf73133fa4bee218df709c84b777b690c8613107ba2743d72525aa8
MD5 a166039e9baf515444cc09b4ca6ddefc
SHA1 3fe9af66bf27abd07bcc3374a5d9b84973df264c
SHA512 22b4f232d45bd97e015c187a64a299af76f9c357de06b94ae047b141ed25cf2ce100763c8d38d3d370222985f3326580cb6e70b0f2f197791342a57f7ce487eb
SSDEEP 6144:AwdOg3n7+4N3q1oqMZHuAx9WtLFA233ekWQi/pZC7hSp33A0NEqrLvNHog:A++IotkC7hWA0NEevl
TLSH
T145747F1EE76625A9E27BC03CCABB5516FCB13C5883E0A6CB53914EA52A03FE4573D701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat32.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api
Size 101KB
SHA256 e11a1df72ecdc578cac2260cd1cd8dd5525a763d47ce8bbaed1d3b50ba1a5b0e
MD5 a222825950a45d6c242e0308f7a6ad71
SHA1 7d9ac13d4a07b24518d595501aa393f6291dd4f5
SHA512 697d4645094a0a68f54aa508b3e3d8ff31996de38ba442aa7db6f0fbdb35cf91f7f53d832f7d0a040b01f2ad3c5c81199bd153f987bb2370e55e54e88d73c610
SSDEEP 3072:pwv7tRdmT7qq8TiPXeYR/TnX8/BPIjNxw+:mn83qxGGYp7s/BgjNxL
TLSH
T101A33A31E919D033EADB0CB9E97E895ECA24ADA24FD564CBF3840DCA0CA46D16F34517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 40KB
SHA256 76487d023b742e534cc04c6faf60f66bf455b0d40b9ba1da71c8d85bd698c490
MD5 cc2c717427576bc322328e0e5f312e80
SHA1 3392bcedcd49f46106862384065c1de36f681351
SHA512 924b0281333b0c4b2dbf599028eebf158ff20481f7041176d8e734b4ce2ba7cf4ad4811c678284c5d602dbec72b4d3a9019ca01fade8aa458cf96cdf8daee539
SSDEEP 768:YW/E7Gq1W4444CzQn674kjzRQsr2R1+FSoTV+w5Df:/4444Cs674kOcM1sStwt
TLSH
T1D9137C4397FC0103EB9B1F7568F1B6110938F6876EF6D61F9816909A2D03BC0AB64B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 0bd95a719151e8985978c9c77055dc93eb5a679dc11de336784b624d93e932ba
MD5 7d7988bbfba87fb61c6dd356dcbe2cd7
SHA1 c63a6d91bb12a00b31a79508ff21c587a298fbb3
SHA512 8721b29610aae115e81e7e0408279ce7b5220a38444ebf76ce5dcdfa4495fb3a3ed8dd613d3a570175e64d9cf872a82fa45ce0504b3280f7d9270028bb1deee5
SSDEEP 384:Zyw5tUebz1qErhM5Q92rbYQujSQxrRjf12ktinYEn2dn5:Yw5tUebz1qErhM5Q92fYQKSQxrRrIR9w
TLSH
T13E52A622C0E8EE719B1712F17DE658210B8E53339A9D1146F89D698FCF0C9D64B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 51285fc944679e1fb4f34d84e9eb764ebf785284facdd7106cf081cf17128b54
MD5 7d2460c45e0bcad73435278b8cafc2d7
SHA1 9f3deb0af8022ef7d27c330f45bffeff82dac1b7
SHA512 20f46c21dd985c6d831ebf28a7ec8e2e14a472a91823fb77e1ac92ef5a5ef8c7279a428e228c4aa54eeb0e1223e3dc26544024eddbad41cb0502c5dffd0383d8
SSDEEP 96:0WLwO9Zc+BHKvPkJUnnrmOT8KaiEZlxnnr6SinnAbBDA:fXJYn2n2dnyA
TLSH
T1D1C1979DC4D8E802E204BA7079E39013168A27F345FD8199FEEA5C9E9F48BD4D6113A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll
Size 63KB
SHA256 c55e9c34f909aef3e70969a577927de726d260f27bbadd89e1c35de51afbab16
MD5 971433cb0345c02ff1454e664a88ac15
SHA1 634077ed2330739d85c7fd3c7c4b2d3983658747
SHA512 b9576574ace68dd6de6a6139a64aabf84f56183651b102a39143f364157139acb1d7e1e76fa2d6712e290b666b40949db1c42e43eeebad4a5d4848aaece5eda3
SSDEEP 1536:qeUisF9ifnyKkV+0b72KCTkmGPUsUAppM1hjw5:qjisfqyKkVF21TVGPUsRppUw5
TLSH
T189535C8263EC4212E5EF0F79A4F1B2114A79F6861AF6E74E1949C1ED0C267D0DE20F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll.manifest
Size 13KB
SHA256 e506197ca441d453580decf9963f40e65a3ad86552923c2d53c11a17a32741ff
MD5 72bc4947c7b1f5a1fef4b0c908ac1fba
SHA1 6da9b4126fcb0da1780cb7680a6612269a0926d7
SHA512 96b5c83440e54edd5b9dfd4cf0c698807eb4530f2b6e65a7121251c6947b46c6455d4ff1770056f476ba84f72bb0a6896d92ee18f64e8e189f2bdd18badf3f1f
SSDEEP 384:/yw5tUebz1qEr5M5Q92rbYQujSQxrjfTr+pWkL1YbybQ/bM:Kw5tUebz1qEr5M5Q92fYQKSQxrrWcY1l
TLSH
T112529312C4E8FE719B1712E17EE558214BCA5323959D1086F96D6E8FCF0C982478B2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.vsto
Size 5KB
SHA256 20ae5f55bb60c85c2f03c49c4f9e74995d74d72fdf1da8984c356aac7e112db3
MD5 d329ede865f73ca67a7caa93909f51f1
SHA1 8ba70f617786387e907f86f842c66003c8b1c6ae
SHA512 baf76d3532c164d28bea468ce52fa22f344765f1223006a147af15a03012aef94b6b0873aa4982f2cb84d0905c364e82fd8f6f84243927b711d6da450edd02d1
SSDEEP 96:0WLwO9ZcsFHKdPkohSX2bcarmOTYaiECwuaCt2bcar86D2bca1bBDA:fvoy2b/+2bQm2bLA
TLSH
T1D8C1B79DC9CCFC01E205E9707AF19553658617B300EC40C9BEAB4E5FAB09ED1D6513EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 37KB
SHA256 50f4b03fe66cf18f47b0fb1aadfbd8ceacaff8750d225dcd3df34720f049002a
MD5 32f341c86521be429a70a99a6bd352b9
SHA1 2d2f1fa1c1d92b47e61193d958c52c0e3bcf12f6
SHA512 82870f98a9c61e18a88891b92ed9a22cae7d9cd8cb19aa096c09ced7618084634619365f9f84aa632b7291e1c03ae35596cf2f448788ab3a11d43f6e74338f0f
SSDEEP 768:bnzKq8s3JRHPSyyXT723OKr2R1fhTV+wG:bnP8+yXT6eqM1fewG
TLSH
T13E036C83ABE84103FB8F4BB8A8F5D6150D35F5CA2DE7D90F641DA05D29127C06B64B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 76777acebc061f0a2684d22a48fdab53547d9cd5a4064cca620a1c27a907075c
MD5 c4072784580e5e851f6aea59001b2a89
SHA1 229ee711a69cd6297a3c17457a6eb01ac0d6b88a
SHA512 9eef542762cb392a201bb0640fbe6cf5e586a14d0627e20a2f0815c4c934c57802191cea746b7cd7bac652b7743df0748e853f7465ea9553dcf4a70e2750a2a5
SSDEEP 384:Gyw5tUebz1qErM5Q92rbYQujSQxrjfWlkaRNI:dw5tUebz1qErM5Q92fYQKSQxrrclI
TLSH
T1F3528322C4E4EE71971752E17DE658220B9E432395CD1146F9AC6ECFCF0C9D24A872BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 8d8d91096c8b10a6071b3426f1267af5ffd710e4f6a8c46fe831ea6ce2803145
MD5 58fb920925cbe2a6e481ab92fce12c31
SHA1 f10fd6a2c0222498eca7dd66bc3d9bd7acdf00ad
SHA512 c9eb2e7b50f263b339a72652b59df30a0ef4e170311ae2727f8ff4a24694102811f0a169edb1477e3c45fce020b15ca2caa1d3a1e3aceb72d81f3af521d4fcb9
SSDEEP 96:0WLwO9Zc55HK9PkdbYxamOOVaiE+tVn+9aU2GoYbBDA:fWdbYq+aA
TLSH
T1F3C1A69DC8C8E801F201E96079F3D1036B8A27B340ED4159AEE95EDE8F49AD2C5113EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 37KB
SHA256 5ea5ace67da224ba517648b783a325b48a6174d8ee6569d46bc26a4cce84932a
MD5 fb7b6b81d0a43a8d320ae07190e3b087
SHA1 12caba8f885d51f31208e605631a97b8d476bde1
SHA512 23a1e266f229dbaf991619fe2af7c26cf45cbe73e14e910029bc0e60f813b03d10f1387f2d6f6d55b5cf9d65642348b32731124a34f49980eb610a05903b8510
SSDEEP 768:J00Lxxk4Di/+gkUplcg+Zr2R1ETTV+wza:J00jI2gkUwLFM1pwza
TLSH
T167035C43A7AC0113EB9B4B7978F5A5124974FAC65DF3D60E9416D09D2A027C06B60B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 3b7c3934776304e67ff5d4390de2ba5524da44ec3f5855bfc27dc648216eece1
MD5 fefce7d2cf51f6942931befbe9ff75ef
SHA1 c89947692d323498bc1d28922717ad364467b84e
SHA512 99e1eb9fe206e184b2b85a247b9f42f7b5a87517c7ca6a8acb132877e1cd3b2734cdde1b21c1d4870ab2713959815a460fee9ce1d828f29046d033d350820886
SSDEEP 384:5yw5tUebz1qErMm5Q92rbYQujSQxrjf2rkBbIHTZm:4w5tUebz1qErMm5Q92fYQKSQxrrKGMzM
TLSH
T1AA529562C0E8FE719B1752E13DE958220B9A433396CD104AF95D6A8ECF0C9D64B472B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto
Size 5KB
SHA256 742edadcd111f5c598740e279c70d543fedebad766054adf1e6e71b789154432
MD5 07ca2141e9ae6e530769cd7e8a959b9d
SHA1 9e3351a7ac2d8a156a8cbf8e836da1ff8ff7e849
SHA512 55ca877d22219f0423f238e78500138b6655c0ad8ce2b42a49276c4569c8dc2dd83b16a378e6631186c69575f5824083be6301134a771f7e48fbad82706baba2
SSDEEP 96:0WLwO9Zcz4HKRPkOM4kvaTEK4mO8H3aiEVt1ATEK43TSDTEKZo7bBDA:ffh4kvkJqracT6ZolA
TLSH
T1D3C194DDC9CCE802F305E9707EE28503128626B345EC419DBEA95E9E9F49AD4C5023F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.4MB
SHA256 0793d50b2243b90670759b9cf37d37e326cf4baf1a2974b09a2340b3c9c217e5
MD5 a02dcc91d3a511c6536397a5a0b3f88e
SHA1 ad364e747a611785ce02f75ade0ffd970a2c180a
SHA512 e4cf0ba5d101d4132978d0ef215772f378c33b7854bc4cc4198b070bbc529f89d30cb9f421e6b651eab9cde6932784c86f89ea3bc2d5ee0de9ba357abd74f8e6
SSDEEP 393216:pG6XmoXA8mOCU2UBzrFSfIz1q/zlOzHihNI0wc:pG6XmoQqn5c
TLSH
T109F68E6AB6A800E8D0BAC0BDCA5A5713F7B27C45037567DB079096B61F37AE05E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 230KB
SHA256 f58d1b78820c44f2e27efeaac7a739337dad2c740f24a3a4058dc8dd222cdea4
MD5 dc4f21742e43886b371db85981b9afa1
SHA1 46bbc59b7b673684bdde096778f9c69799d69490
SHA512 500eedb873b343ec997693a0eb4e9947e0382199393d47ad76c781f5ed35636a5418925eec2c94be74507555bc406c02b5315ffd29595d9e03c07865daa7e82e
SSDEEP 3072:4DlgMf07KkFc8MklfKcnyMUdsoyko7lVPm9d5Fr+OaKLErEPDjmjwP1X:4Dl7f0FMVDds5k6U92jQX
TLSH
T17A344C56A5AA007ADD66C538C9438D01FBB2FC4507A09FDB07810EBD9E5B7E0AE3D742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 187KB
SHA256 aa8e48c4d5f8e0b26e51c9a3e28d3f021c109f845ff42f197b5519e19b8a6eea
MD5 0fb295a4ef8ab21c5f987d504dd54594
SHA1 705b32de685cc4762018024cfbe83d508b679db5
SHA512 5a10faced67c8bffe3576f2be6168be80dd830d5180d908840ac8aae4a1ba6d0c341aeee1d267b9e172db7858ba52c5c6e0b59c206d2a438fcef9cc27494cde4
SSDEEP 3072:GJmOgbYVyiUrPyQlImdqPXtd4Kzl9qhZ7Yhiasul6s+9zo+JwHPJ:G4OgbYuPhJSdi89QLxo+JU
TLSH
T16C147C12B861D036DAAF09B45968DB629F3E6D51DBF095EB37800DBA5D203C4BF34B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 86KB
SHA256 9af58e4b434962f3411fa034a46619ca90e75445d31ae757f9ec61110229e5cc
MD5 ade8e3eba678471cd72dd3144b7ca427
SHA1 9e5a592fd36c98839fdb4a0a7a841e4a3ff71363
SHA512 a090b990d6ad4523b5dab808d146b64205da35ce51e220a4091aab022bd08aa773b58ee51684526d1d5650af124a17fc4f742b58cad99275d44b7470660de4d3
SSDEEP 768:YPv83Yq/0N6RvthIRU+F4kDBwwJhkHvAbtyVe+fSlKseIr2R19WTV+wCJ389zX1:IqsNivvIRU+FxDSwJtAgM19jwCJkzF
TLSH
T11C8306421A6500A3DE16C634C7B7EF27F672F5281F6217DF0A8689AC4ED6FD05E2B610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 73KB
SHA256 4456309f6d6ff9b8f284e49b3dc27d8db1bedb3116605a59d5105e6a10b6e489
MD5 acd2d9082b44bdf050535dfef32f0a9f
SHA1 020c76f91e685a0bfc904b1a33ffa9fb426babd8
SHA512 15da854d8385baf92a3a231d53235b9f987947029a04a2a22dbb25f24c4207e7518090299831afed38a560a02cc0efb3afbdd56bb6fb2e671ee8a76bf2dc7c09
SSDEEP 1536:0O5JvFtaJsM3k1NURVXkKM1HwWIPzvy+4:jPvLaHRVX9WwRPbyL
TLSH
T1EF733737690201F3FE9DD9BDF6A865321A7C97A1C3F750E7A5429ED408003EA7A27306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlp.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll
Size 816KB
SHA256 3ba5357618faf76f5079a036d3f5f269334cf552d9d931fc2097e25f0158d9c0
MD5 53f6bf23ce195563069cb651938f0a59
SHA1 ad4f7fdbe2f9edabdf035a4ce0695fd50200e9fa
SHA512 dd4cd523808d3ae9657553b184c16a6b9e100aa87043ae531aaadeec14ae20de7852308e00e3559e1a6ff94598659874a96b3f2364cae8f33df5305c3a9b9f45
SSDEEP 12288:Xm05yqtNSmHRTMcNxguWe4Q91YhKzvmhQhjq7ZF:Xm05dtEmR3Nxq3Q91YQzEQhjI
TLSH
T1FE055C3EA26C52B8E1B694B9C65B5902F6B1BC0253B45ACF03911A753FB7FF4163E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll
Size 684KB
SHA256 75e59a8405d935192ac8c8c8d828545a5aeceb9d40680a933dfef5b59622b579
MD5 5325c79159458b07661e104bf83fee8e
SHA1 e61f1a417bdd441fcf9b8604d94415256fc039f2
SHA512 11b516b4be48f0de260f4af7212ac3b6f729e0020243a624d9b0ff6c7b9e2913cb4c8e8b52ea8081a25d59ef59ddf393a39cb97623e39428f7938186e51cae2c
SSDEEP 12288:mwASHvX1dx+P7z073vLf02OZgemf7g+JT:mwAY9dx+P70LROZgemf7g+JT
TLSH
T1EAE47C327691C1B2E59E96F06128DB6A55BC64362B3129D7C7D06FAE4830EC0973EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.4MB
SHA256 5a137b10aac9796ff1b2d5b8d24758dcc5b18b72aea9afea5fb2fa52cd9ab986
MD5 02ca08d641352e166f7add3f2a442ff7
SHA1 7bb64f743b4a224a755d3fd671848b2597e49abb
SHA512 906e10193f4052c9be77ba643b45e13fbf3474d6a3fe8f192d44dae342f0234cb49351e748bc9a75f60e1081fc69287204f5e0ef4b2d376790692bd206bce991
SSDEEP 24576:h/I0dayjhrDVTTRF+Be+fTcJclJ6tGmBG2OQ7abGtphB/OBH4OMlDH:1TjhrZT1UBe+fTcJclJ6tt7abGtpDOBc
TLSH
T190651B21232B2E63D6573378FBD31EA1A3346C4573566347729FA0250AE628CB2F7D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.1MB
SHA256 1513d7188d40255384b050c172ccfc0268625c9e9cade4a372d82519dd0b61e1
MD5 9a52e1b188961b429b54e318b83ff2d0
SHA1 d1a536a442fb33081114dc4f72545a0659fb3b85
SHA512 7bba8afc9c1cbc9c7635ba37ffbaad4c632f923364c20f8fc537cdb77e7438d8d63184dc2bacc0d53c9481a1d5778c11ef95f21a802a970260a3a52e02444b14
SSDEEP 49152:zGtlqhLVwASOybbGohEzkaLWICotftCE2cM3TJxT+zQmySTc1ifQQwdPPqSXDA9y:eEd2HjXTPmy0cNfUjdud+ecO
TLSH
T1C7469D69A5BC00D6D8BAC1B9C2865227D771B85547F057CF2A6086F61F23AE42FBF700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 3KB
SHA256 d01c5fd7f7e23265b3b819d31e76db93a9c5e58d0ee27df26087d26ba6cee9a0
MD5 d0dc4987166ded70001797f68667ec05
SHA1 0b9aaebaa11128e5ff39c6a5c4dd90d26c80ac22
SHA512 e8d8a5c648008870fa08f2a4efd4649fae69a69c3f8645b7c79a8f06969427a8a2da8d2a1845b16b66d9ef3d1019db4b88fa458261cc402ffdf6d601dc29dd6d
TLSH
T1C9810F587791867CF85A3210BF17384BB3A53190D0F8306136DE8485E3D6A9EC5B07FA
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 244KB
SHA256 c5f18125d67e3308c58abfa6da14bb7e856926ae7d08140a4dd9660d31a1c2d5
MD5 954cc54987cff330509b4a7fc8f5a6e9
SHA1 271a2d9f12638b39ddc3dfd89118fc716000b28a
SHA512 2815b40fb3e9b29353c507e455bc49ecc2a136018a31d8794113df37c545dc244822890bbea8b84d32fad6b04ec0f7b7da285042607b41676722bef570a3f995
SSDEEP 6144:FAM7y6LUk6o/mEFjI0yFpktvGioozSqCjAd3pgZ:Fe6LBLmKBfs3
TLSH
T127347C16A39509F4E9678274E9B2C223DAF2B4452721C6DF02A4819C1F2BFD0F97DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 78KB
SHA256 933ffd8e7b26f6d93bdb9381176b25f8a1f4dde0fcd3f6d586720b97811a8989
MD5 dfc2fe152079783494472d460679178f
SHA1 c7f51f02316e59ef567451c6bbbfe6302f1e2a88
SHA512 644354ed4b7c7ca56c8d8367a782222209b808cf7be367200dfc22ba4e3f86b66639e4e44f60ee35600cfbe22275968510c2f010318b1f536cf2865ebeb726b3
SSDEEP 1536:qzrSh8OvYIKHNAnKalcVpFHZL1P0eM186wzfzBm:M/OwISAnKalcVpFHZL1P0e8wLQ
TLSH
T12173186233A80CA6CE1592348697ED12FAF3F509276146DF0296798C4DA77E07F3861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 68KB
SHA256 66bb33ab8b604d4b4ac93f92d3766b62b2e1bd648135d30a13bb20af38536f36
MD5 6edaeec0a172f9e649d2fdf4b418f1c7
SHA1 ab6c4cf4bd0f58494ec930baf3f9446f8a34e42e
SHA512 8ac309e6195957461fd15cd8a211b3fea2003ab4d679af2468c28d1e983daabb86d2b5e24c4ae1fcff266e859973a5f24935e37ecb77ab9465129b02e57b9b40
SSDEEP 1536:NqTkFCQ0U38jg3KqlslkFHZL11Yk5M1SwGWPzK:4k2jg3KqlslkFHZL11YGLwrPm
TLSH
T1FE6329D2BA1811B3EEEC5C71B6AC753299695A101BF684F36D583A888C07BDD7E34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 3KB
SHA256 238ef6497eddee643e89af13772cc37cf37da6f47134f87e0ffd1a55f5e2249d
MD5 1e1b9e09684a0ed8b9944ed002b7998d
SHA1 2f59e89604641c7b28ff33a868476d9141877755
SHA512 28219adb89586e93e78f77331776721ced06163758a5872bc7cb38ad9bc6e1cb437b39b638c681d8bfa83af0a31ce8dbc20f82b9723cbcb512527aa49389ce37
TLSH
T1868157B7BBCB55783C4053805C23796308E9DE7AF97A14102AE46E8C4DAB917432FC7A
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 19KB
SHA256 b6971113eb5461a0623c9ba0c5fc2836111884970252c22bc692cfac8d6149f5
MD5 c29e705f77f5ef2269323f1a13898f62
SHA1 0d0c8a03aa59614b7f39d7f16c763210df38a159
SHA512 bfa4ae16eed2105f1bf872a95fb1b20a41ba3ec1df7e5bb98cf9937d50e87bb537a33dc6c0ae7bf5bc1384399a0a8e19c9bac5672eae1bf62c19bb40044ea606
SSDEEP 192:J4Vj1aFClJbfdEmyHK/Tw9YpqChOxWP7Dm0Sr8ZjW4lulJlslplUlbATSpqRSv+p:Wsfa/SslbgDnSO6IMEwL
TLSH
T13F92BBB4BB8FC2B03D1123D19A327E8609E4ED2BB4AB18527FD11F8D81D1916736D8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDCD9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDCD9.tmp
Size 5.5MB
SHA256 d449d11eb954c555d5839799d5689255a74fb5cc690a4004eb32ebc92e7ceb5b
MD5 fad8ff0eaa53da65e82b6dbec8da666b
SHA1 36b20109257a68a386482885746f62582e57a0a8
SHA512 ceca56a519e104ffe9d59af42d2cd2678971bef3cedf5b1054e70fc538b63c7d35e527a94f6188e32a23bafe65745fe587292b7a68bd2e62822132b5d42ad225
SSDEEP 98304:04aMcv0mE5u6VZE1j5Wc6bDGsc+pgzNWh7sX5aDaE6P6t:0ucTE5uQEWcjWh4MDa/P6t
TLSH
T1CA46BE22BA05C071D58D02B1757E9BBAC53D6838973449C7ABC01F7998211E37B3AF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5cbccfe746f65a3f65035f58f431522a94f795bf4a4d66dbd2d62c99266b141b
MD5 652cefa163554c493d032dd14167da4a
SHA1 8c9e3b1717c832cdcb09578bcced2c5b9c6937d5
SHA512 fcf48be87a662f6a096ef89bc70bea438f948d5826c52e3f301e6c732a9aec98ffe5e8d703f74b51b6663cd5d39c001593198638092f92db135d0d3b2271d78d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e7a56b86b1775f02803da41f794ca964e4c4f24ee616f5afe6017920eb06c2b
MD5 9d7c5abe5872c0b32ab2aa89b443b98c
SHA1 fc3c84ca9bed63ad52c14317cac43c9f0a60163e
SHA512 8ecc5fc6bee1e0a341ac42d588f4e0999ec2df7d773557eb537585cc596eb065c5e02e715913cd9bc30982759833dc1ad871e745e2f360e5cac9332f987f37f8
TLSH
T123D0121276024134C470357305137A092450C61F4005C1009428855D2F04C500D12841
MD5 SHA1 SHA512 TLSH

Submit Download

674d4289-758d-42fd-84e1-6afb2a21c560.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\674d4289-758d-42fd-84e1-6afb2a21c560.tmp
Size 6KB
SHA256 adc6ff5b7d5ae36977c048801f7b61d95b4c71299ef076adc84da3b045d0f977
MD5 551721eb628de5eeb9d3b4d7a4dfc36a
SHA1 498dd4256403e641900bde1f7ea7e4583e42ce35
SHA512 5a22f7aa98de092fb4592fec0d2754106965e1917f1b07b17495f8f4fbf3ca9f75b2b7f57d16cf1012ac1034115eb687e03bb749f95c5669c039032a546a7282
SSDEEP 96:styg/dyTrub9tkZo52F16ZZs7/x+6Mhmuecmje3K+gcid28XM1C7jL:stzAWIodsV+FijxHdG6v
TLSH
T14AD185125E28797B4CCBF509BE297A43D2F9603275951E58F7F8462C08EA6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad37e.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State~RFe5ad37e.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 50a53c6f7329236268e2395d125363bb9a58f226d943ab4b476011105cc0609c
MD5 fe8d579b26fbfe633d3a552bdb8d0a2b
SHA1 dcaef4a915155594722edb5f194d97e2fc8df635
SHA512 a1df0e69a0eab34a7b9d08de41424a836643f69f3e450271a397e81874812539592071c66caac76f3181fb23276bb743b725352185cc9d5081016b4276a35690
TLSH
T1DC6164366970EA379DE38E05B98A3F06A7A59173E5913F65EAED1E0C01D739C1301C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 15KB
SHA256 01c6142dfb356bb30530b379696c3b8b007a6a2f15f3385097e0a5682b98795d
MD5 a37b08051497b52e4bb92758142a14d2
SHA1 43e68f6aeb829250744e63dba63706bdaf59b48b
SHA512 c90be36598550924b179b52d112907356a19ed0ce1b4915a5a1ab3a295cca10dad62d582c22fbc4709cd2755b8dc0c4fca6aaf6d073f2b8bc70e0f1074adf89e
SSDEEP 384:n+aQikB+z/xvxjg/qhEwNBSmjvm6rOAVdpj+lM9zi:2/UxvxjgC+IDOUqqFi
TLSH
T188729E2B94697E23A5F7AE057D5D5B8BCBF884B251C12EB84AFD6F0D06C73E80341816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 2KB
SHA256 dc6e0ec868acaf1381ef682dc74b9d0ac82af591f16d724f4c45aa2dbb98928e
MD5 2296c72ec638d3f944c7af67ef033a0f
SHA1 81f8a18e65607870fc11a5f74f0e47197535a312
SHA512 123c92d2d8ceb1174a29192959219e395b610ce324ad45f41265c97ff80e3ed400c504f91d82b931eb82b70fee8702c4dd53fd5ca910867c8a05dd55a8241ed9
TLSH
T1495153336820AB37D9E34E057A4A7F53CBB591A296522F60AADD1B0C01D725C2705C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5aa903.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State~RFe5aa903.TMP
Size 1KB
SHA256 ec71de8e2d70f620a1fb597c9675bfb7b30b8a0429facdbc7164521a21f0c4c8
MD5 e76f935a82b69d9ad1645e3b85e2a781
SHA1 84a62b3d64d8d088ba7f07e53797280d8312a95d
SHA512 0feb49e7783a4267b0358249430ca647a43a238b29d14f859d0c4f0405b8643601d139ee1f0d199ced3d7c309918d41289e0aefec2e7be994e55ca06c6346786
TLSH
T19B213272E5609F33EC961E06365ABF879EB190B782114F0475EE9A1C02E319C9A29C32
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 9KB
SHA256 b61eb0ad360ce6980339aa1bb5d10c17a40065c7ab7f05fa7aeec5fcddcfea1b
MD5 b56e71c7eb0003bf78d6df0550864267
SHA1 9163f0a316f0091eccdbd6fde03049dfbfe4d198
SHA512 e59da8276024fdedbde0bd886788e2b038d69f58e057f95913447969658ecaf0e6f80ab115ab9f691fd2a3ecd8f289b9a7a6ec6d14e1376e6787119c22438130
SSDEEP 192:XdTd6x9wyhZ8Us8uBZdhthKPTh0d1ryqF:XdTIx9wyhZBslBZdhthKPTh0dv
TLSH
T13922C0130A8A08FB27161DAAF549592F0F67AE7F351ED515B5FD910C6E08028A36FCBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 1KB
SHA256 1dce251912e7e27cb754b94af73bb740b65c8ba970acf08a19f13914a28a5b34
MD5 e5345a2bb3b64f8a0971433713a75d92
SHA1 07cac2890089f828d6464260174a5315d89ea239
SHA512 4baad1f7e0761390cad23739021d044510ead4cd04db9bb9027ebaaa84e96fe12a7642922559987309b74ee85821cefb8aaabe0638fd36460c0bfa0a1f8a7d4a
TLSH
T1FF310322C70710BD3F433F4BD343DC2145D66C0783AE4B6279EF62029B09A94626EC67
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 de2db4907be0218e88ecb20bfa4d4dc25406f9658c7fd2e1eb2480029cf4916f
MD5 76d23cb2e7fa127e4eb2f6d0b118d910
SHA1 e9cf29fac1560dece4fc5dc7d898598983bacaee
SHA512 14d07c7b8077408b5103064a6b19575da95884c08cfc5f4e8cd10f24b094275b5c7d0704f4befbcbd59713a544784fc66190f8e06c0545b64be68c57c0cb67c5
TLSH
T13671CD13CB0B14BE3B533E4BD747DC650A866D07839E4B727AEB63069B0C954225ECB6
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 11KB
SHA256 44408cf4e7b9734e6e35dc9771f281aaceed1942c10cb1ad2e9082d2c7c7dce2
MD5 207a538d1543775cf4cfac3f9598a2f3
SHA1 a96653f9d1aeda83e21f099a35c31dc0bea33e38
SHA512 28f1d943f7a4aca8753cf22a71231fbba9c6f34c5c16925883701826a062c7097199ac218b4f5dca8b9f70c34292eac22db15fd352aa4a13a4c855c6a6d192d6
SSDEEP 192:xw1wbYpLM5NyRW9Mv3hy1DyX9WaRxKpSPSPy/603/ag:xm8NyRWO3hy1GX9WaRxKpSPSPy/9
TLSH
T1E942FC13CE0B54BE37533D0BD74BD8390B52BD0757AA4AB23AF92306AF0855422ADCB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7DB3.tmp

Path C:\Windows\Installer\MSI7DB3.tmp
Size 571KB
SHA256 2b3aaa5f6e352acc503810ca71d6f33c9f9db317b6c3a8b65f2fb57abba04ccc
MD5 52420c9e7c5eaafea49dda57f29e3546
SHA1 7362636084f5306fb0258c2708101bcc16269fc5
SHA512 bc1429fba0d08e97dd72e101596b81381b276fafe4e675e2795c182faf5a845db3735bc96b6cd347c4183b9e91c46824fe99e7841d55285b22c14e7db1e08771
SSDEEP 12288:nVJpggTxyuSCErtpWU4hhCkph0lhSMXlAlRDmjh:nVL1VzK3W3rC6h0lhSMXl+C
TLSH
T1B8C4BF19B3E542B9E1ABC174CD930926EA737C444361ABDF03919AA21F237D15B3FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 8519a2bf9557b7020627bd232ee4f993957766a19ace9753bf51770e9d4e8bd1
MD5 509c4369ff9760efc87aa54fd6455e60
SHA1 3edce44b9c33d36c832a6711c150437c9223fa6b
SHA512 db94ba68a8643684065a05e32bbe51f42f462feff2abec9df09d2e27b6686ab20472f15deead4f42ad007c94616c5fb02ce20433c24d69b5715595f43bfc2a36
SSDEEP 24576:jFo3DMPedoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuo:sHE
TLSH
T1F357B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{793f209b-6e81-4218-bf62-8f5a16144207}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{793f209b-6e81-4218-bf62-8f5a16144207}_OnDiskSnapshotProp
Size 6KB
SHA256 0a39b974d46783eb96057cb9a9f045a391ebfcad31ddd4120fae489317acaa37
MD5 eb85c87c19371ef2e37948882abfdade
SHA1 713e2acd85d28b0746dd349d79ff4044e9ff7361
SHA512 ff66c2da77fab3a993974e15c4aae587e9533e7ade06153df51e5b40f702554c57c495e6ee6125b2f480c61973c94e54eeaa7ad8ad6a9e67b86f9fb4fd5033d0
SSDEEP 96:FumPrFlFvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:brhb++uVm
TLSH
T1EDD178185AF54311E2B3AB3169F14557A837B911EF33CB8E0198238E2661A10F975FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-592-0x00007FFC46C80000-0x00007FFC46C81000-memory.dmp

Download

memory/1732-1090-0x0000000000770000-0x0000000000E8F000-memory.dmp

Download

memory/1732-1092-0x0000000071E20000-0x0000000071FEF000-memory.dmp

Download

memory/1732-1091-0x0000000071FF0000-0x00000000723A5000-memory.dmp

Download

memory/5160-569-0x00007FFC46C80000-0x00007FFC46C81000-memory.dmp

Download

memory/5800-1143-0x00007FFC46AD0000-0x00007FFC46AD1000-memory.dmp

Download

memory/5800-1142-0x00007FFC45430000-0x00007FFC45431000-memory.dmp

Download