3a89ce5e8bd0121039198b33bf23144021dd534fdc09d5ea9babf8319f4572a9

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 37.5MB
Sample260804-akb7mazdje
SHA256 3a89ce5e8bd0121039198b33bf23144021dd534fdc09d5ea9babf8319f4572a9
MD5 afff9c9ac1799f44a036161f7e618b0f
SHA1 fc08413397140ce31c106a00bcffc62807343795
SHA512 a7c945faf57d3b87e0b84fa5ff6d8f699b18dbbee1b611249a7950df9f0d77bc534b32728dd88479afffb19b43a9729787c1a57e758638f4f1c3ad38d4a2798d
SSDEEP 786432:HGe27esGvGjc68MURuW/vIi2weNQAtdAToxMwD:meyD0glURuW/Qi2weNZtdHy4
TLSH
T1A5872312BA42C071C59D11B1E56A97FAC53D6C24C73044DBA7C43EB9B9312E37B3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5932	stadrv6x64.sys
5844	stAgentUI.exe
1640	stadrv6x64.sys

Loads dropped DLL 22 IoCs

pid	Process
4712	MsiExec.exe
3140	MsiExec.exe
3140	MsiExec.exe
3140	MsiExec.exe
3140	MsiExec.exe
3140	MsiExec.exe
3140	MsiExec.exe
6976	MsiExec.exe
6976	MsiExec.exe
3140	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
6164	MsiExec.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
6164	MsiExec.exe
6164	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6840	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx64.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat.api	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx32ipc.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfium.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp-collect.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\chromehelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx32ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-fr.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfiumx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinterx86.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\epdlp_hook_hlpx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp-collect.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\arm64\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll.manifest	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nspacparser.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker32.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker32.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x32.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx32.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\pdfprinter.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp_man.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\fips.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\epdlp.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.sys	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx86.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.vsto	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tloader.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_hook_hlp.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\chromehelper.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\x86\pdfium.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\openssl.cnf	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\pdfprinter.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest	msiexec.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59f35f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{96F1068D-FC8E-467F-9438-160593C919E1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2EAD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7880371BD5210987.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2061482385\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_446933727\crs.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI345E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF09ABDC344EE43CFF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2061482385\LICENSE	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI237D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39CF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2061482385\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI94D1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_446933727\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_446933727\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIFF19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2881.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3016.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3895.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA25.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2CD6873EDB96E6AF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3036.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI965C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7F814D3806FCF2A8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2061482385\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_446933727\ct_config.pb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59f35f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3942.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2061482385\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_446933727\kp_pinslist.pb	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6840	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c4492839-0000-0000-0000-d08302000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c4492839-0000-0000-0000-d08302000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c4492839-0000-0000-0000-d08302000000}\MaxCapacity = "94852"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	MsiExec.exe
1516	MsiExec.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5560	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6840	msiexec.exe
Token: SeSecurityPrivilege	4872	msiexec.exe
Token: SeCreateTokenPrivilege	6840	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6840	msiexec.exe
Token: SeLockMemoryPrivilege	6840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6840	msiexec.exe
Token: SeMachineAccountPrivilege	6840	msiexec.exe
Token: SeTcbPrivilege	6840	msiexec.exe
Token: SeSecurityPrivilege	6840	msiexec.exe
Token: SeTakeOwnershipPrivilege	6840	msiexec.exe
Token: SeLoadDriverPrivilege	6840	msiexec.exe
Token: SeSystemProfilePrivilege	6840	msiexec.exe
Token: SeSystemtimePrivilege	6840	msiexec.exe
Token: SeProfSingleProcessPrivilege	6840	msiexec.exe
Token: SeIncBasePriorityPrivilege	6840	msiexec.exe
Token: SeCreatePagefilePrivilege	6840	msiexec.exe
Token: SeCreatePermanentPrivilege	6840	msiexec.exe
Token: SeBackupPrivilege	6840	msiexec.exe
Token: SeRestorePrivilege	6840	msiexec.exe
Token: SeShutdownPrivilege	6840	msiexec.exe
Token: SeDebugPrivilege	6840	msiexec.exe
Token: SeAuditPrivilege	6840	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6840	msiexec.exe
Token: SeChangeNotifyPrivilege	6840	msiexec.exe
Token: SeRemoteShutdownPrivilege	6840	msiexec.exe
Token: SeUndockPrivilege	6840	msiexec.exe
Token: SeSyncAgentPrivilege	6840	msiexec.exe
Token: SeEnableDelegationPrivilege	6840	msiexec.exe
Token: SeManageVolumePrivilege	6840	msiexec.exe
Token: SeImpersonatePrivilege	6840	msiexec.exe
Token: SeCreateGlobalPrivilege	6840	msiexec.exe
Token: SeCreateTokenPrivilege	6840	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6840	msiexec.exe
Token: SeLockMemoryPrivilege	6840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6840	msiexec.exe
Token: SeMachineAccountPrivilege	6840	msiexec.exe
Token: SeTcbPrivilege	6840	msiexec.exe
Token: SeSecurityPrivilege	6840	msiexec.exe
Token: SeTakeOwnershipPrivilege	6840	msiexec.exe
Token: SeLoadDriverPrivilege	6840	msiexec.exe
Token: SeSystemProfilePrivilege	6840	msiexec.exe
Token: SeSystemtimePrivilege	6840	msiexec.exe
Token: SeProfSingleProcessPrivilege	6840	msiexec.exe
Token: SeIncBasePriorityPrivilege	6840	msiexec.exe
Token: SeCreatePagefilePrivilege	6840	msiexec.exe
Token: SeCreatePermanentPrivilege	6840	msiexec.exe
Token: SeBackupPrivilege	6840	msiexec.exe
Token: SeRestorePrivilege	6840	msiexec.exe
Token: SeShutdownPrivilege	6840	msiexec.exe
Token: SeDebugPrivilege	6840	msiexec.exe
Token: SeAuditPrivilege	6840	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6840	msiexec.exe
Token: SeChangeNotifyPrivilege	6840	msiexec.exe
Token: SeRemoteShutdownPrivilege	6840	msiexec.exe
Token: SeUndockPrivilege	6840	msiexec.exe
Token: SeSyncAgentPrivilege	6840	msiexec.exe
Token: SeEnableDelegationPrivilege	6840	msiexec.exe
Token: SeManageVolumePrivilege	6840	msiexec.exe
Token: SeImpersonatePrivilege	6840	msiexec.exe
Token: SeCreateGlobalPrivilege	6840	msiexec.exe
Token: SeCreateTokenPrivilege	6840	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6840	msiexec.exe
Token: SeLockMemoryPrivilege	6840	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
6840	msiexec.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
6840	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe
5844	stAgentUI.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6840	msiexec.exe
4872	msiexec.exe
4712	MsiExec.exe
3140	MsiExec.exe
6976	MsiExec.exe
1516	MsiExec.exe
6164	MsiExec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4712	4872	msiexec.exe	91
PID 4872 wrote to memory of 6920	4872	msiexec.exe	96
PID 4872 wrote to memory of 3140	4872	msiexec.exe	98
PID 4872 wrote to memory of 6976	4872	msiexec.exe	101
PID 4872 wrote to memory of 1516	4872	msiexec.exe	102
PID 4872 wrote to memory of 6164	4872	msiexec.exe	103
PID 5844 wrote to memory of 5560	5844	stAgentUI.exe	108
PID 5560 wrote to memory of 5612	5560	msedgewebview2.exe	109
PID 5560 wrote to memory of 6736	5560	msedgewebview2.exe	110
PID 5560 wrote to memory of 6736	5560	msedgewebview2.exe	110
PID 5560 wrote to memory of 6736	5560	msedgewebview2.exe	110
PID 5560 wrote to memory of 6736	5560	msedgewebview2.exe	110
PID 5560 wrote to memory of 5452	5560	msedgewebview2.exe	111
PID 5560 wrote to memory of 4972	5560	msedgewebview2.exe	112
PID 5560 wrote to memory of 4972	5560	msedgewebview2.exe	112
PID 5560 wrote to memory of 4972	5560	msedgewebview2.exe	112
PID 5560 wrote to memory of 7088	5560	msedgewebview2.exe	113
PID 5560 wrote to memory of 7088	5560	msedgewebview2.exe	113
PID 5560 wrote to memory of 7088	5560	msedgewebview2.exe	113
PID 5560 wrote to memory of 7088	5560	msedgewebview2.exe	113
PID 5560 wrote to memory of 7088	5560	msedgewebview2.exe	113
PID 5560 wrote to memory of 3116	5560	msedgewebview2.exe	118
PID 5560 wrote to memory of 3116	5560	msedgewebview2.exe	118
PID 5560 wrote to memory of 3116	5560	msedgewebview2.exe	118
PID 5560 wrote to memory of 1712	5560	msedgewebview2.exe	119
PID 5560 wrote to memory of 1712	5560	msedgewebview2.exe	119
PID 5560 wrote to memory of 1712	5560	msedgewebview2.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A1CB701B4EBA86029DE8BCF1B4B0664C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4712
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9B6389553A1BE5E27922535ED0938B8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3140
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7479A8E553D756AD24ED30C03C3B1668
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6976
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 26D2A5C7A13DDE994A2CF92FCCE63761 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1516
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6512D0334F32F8B09DBC8095BB0B6258 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3352

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=5844.4984.3834946146942477017 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x198,0x19c,0x1a0,0x174,0x9c,0x7ff981f55fd8,0x7ff981f55fe4,0x7ff981f55ff0
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:2 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:3 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 /prefetch:1
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=139.0.0.2721 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1752,i,15879119826004769957,16167852214032217067,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:1712

C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys
"C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys"
1⤵
- Executes dropped EXE
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.6MB
SHA256 03ac79db9ae599f7c23a39038740f46a6c879a65c079bdeee3acc4bbf34b0237
MD5 a54aae857dcb499693d58a71e9db154c
SHA1 99f0f46c86c6f13ccb436a1dcb851390c3583a61
SHA512 37f3ff6ceded1a72bf2b085c5441b0f28ab188acc14d947d4df84fbfda9b0b44cb56b4bc3bac8d2fb59374aeb6f189a29710d35bfc2889221d3394b97c8d96f2
SSDEEP 24576:sIb7MbT+qGYZtIx3oJm+OfC3OjUXcfLbCi2kwXEW3TW/Qba:sY0T1Gj457czXgXTpW
TLSH
T1D9756B57B6B440A8D1A6C038C5176707FAB1748A0B709BEF12A08B6A7F07BF59D7D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 39KB
SHA256 f28f6345aa228c1e8250d3fcdefef55c435a54b893daae59d338672d2af6a0c4
MD5 27f5458d2c949011c4f7395ebea2f4c6
SHA1 f844b3cf857c79dda7e253ac45706f529c3cbcd1
SHA512 46efb43dd3864e539f6ba17b6a3b451a91bd9630c010112472e4410c2c6b4191fbe0769bc717ef8d18c1d6fdb3bba12e38a8b5a95a6ed1f882c31c63dc00c19b
SSDEEP 384:qWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/Tjd:fwJTwYB4E5n/xe5arvur2R1dATV+wXC
TLSH
T111032C0296BD8323DA994E34FDD0B9516BFCF7C379EAD60F500AD1A648853819A90D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll
Size 47KB
SHA256 018f5fe2880c5419cda8d2af19cd0aa3c5375ec20378b854fdce63932ef1d997
MD5 475f329e73357d2ec0a76edf181a3f73
SHA1 6762ccc2e6fab8961c48dd5591432126bff3754f
SHA512 d6093f890a770bb4bb1050cf024127c7935faa2c5f8a0fa3f5611ec123b3fd92b192c616abb68395414179557fcaf00c8e4e82c6822c30fee337daf4fcf95e8c
SSDEEP 768:P7vV5z3+6KTqUPtLnPDiQ0fWST41mocNAwkEGjhl2BOBaBnD/4xFsOjMi2jXHU1d:TVs6c3dQ9rHUcE
TLSH
T11D23A681C019F261E80D983435B0FA81F6BEB7D72FE9F64E9212FEF44052359E194E99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api
Size 330KB
SHA256 6e975d70aaf73133fa4bee218df709c84b777b690c8613107ba2743d72525aa8
MD5 a166039e9baf515444cc09b4ca6ddefc
SHA1 3fe9af66bf27abd07bcc3374a5d9b84973df264c
SHA512 22b4f232d45bd97e015c187a64a299af76f9c357de06b94ae047b141ed25cf2ce100763c8d38d3d370222985f3326580cb6e70b0f2f197791342a57f7ce487eb
SSDEEP 6144:AwdOg3n7+4N3q1oqMZHuAx9WtLFA233ekWQi/pZC7hSp33A0NEqrLvNHog:A++IotkC7hWA0NEevl
TLSH
T145747F1EE76625A9E27BC03CCABB5516FCB13C5883E0A6CB53914EA52A03FE4573D701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeAcrobat32.api

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api
Size 101KB
SHA256 e11a1df72ecdc578cac2260cd1cd8dd5525a763d47ce8bbaed1d3b50ba1a5b0e
MD5 a222825950a45d6c242e0308f7a6ad71
SHA1 7d9ac13d4a07b24518d595501aa393f6291dd4f5
SHA512 697d4645094a0a68f54aa508b3e3d8ff31996de38ba442aa7db6f0fbdb35cf91f7f53d832f7d0a040b01f2ad3c5c81199bd153f987bb2370e55e54e88d73c610
SSDEEP 3072:pwv7tRdmT7qq8TiPXeYR/TnX8/BPIjNxw+:mn83qxGGYp7s/BgjNxL
TLSH
T101A33A31E919D033EADB0CB9E97E895ECA24ADA24FD564CBF3840DCA0CA46D16F34517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 40KB
SHA256 76487d023b742e534cc04c6faf60f66bf455b0d40b9ba1da71c8d85bd698c490
MD5 cc2c717427576bc322328e0e5f312e80
SHA1 3392bcedcd49f46106862384065c1de36f681351
SHA512 924b0281333b0c4b2dbf599028eebf158ff20481f7041176d8e734b4ce2ba7cf4ad4811c678284c5d602dbec72b4d3a9019ca01fade8aa458cf96cdf8daee539
SSDEEP 768:YW/E7Gq1W4444CzQn674kjzRQsr2R1+FSoTV+w5Df:/4444Cs674kOcM1sStwt
TLSH
T1D9137C4397FC0103EB9B1F7568F1B6110938F6876EF6D61F9816909A2D03BC0AB64B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 0bd95a719151e8985978c9c77055dc93eb5a679dc11de336784b624d93e932ba
MD5 7d7988bbfba87fb61c6dd356dcbe2cd7
SHA1 c63a6d91bb12a00b31a79508ff21c587a298fbb3
SHA512 8721b29610aae115e81e7e0408279ce7b5220a38444ebf76ce5dcdfa4495fb3a3ed8dd613d3a570175e64d9cf872a82fa45ce0504b3280f7d9270028bb1deee5
SSDEEP 384:Zyw5tUebz1qErhM5Q92rbYQujSQxrRjf12ktinYEn2dn5:Yw5tUebz1qErhM5Q92fYQKSQxrRrIR9w
TLSH
T13E52A622C0E8EE719B1712F17DE658210B8E53339A9D1146F89D698FCF0C9D64B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 51285fc944679e1fb4f34d84e9eb764ebf785284facdd7106cf081cf17128b54
MD5 7d2460c45e0bcad73435278b8cafc2d7
SHA1 9f3deb0af8022ef7d27c330f45bffeff82dac1b7
SHA512 20f46c21dd985c6d831ebf28a7ec8e2e14a472a91823fb77e1ac92ef5a5ef8c7279a428e228c4aa54eeb0e1223e3dc26544024eddbad41cb0502c5dffd0383d8
SSDEEP 96:0WLwO9Zc+BHKvPkJUnnrmOT8KaiEZlxnnr6SinnAbBDA:fXJYn2n2dnyA
TLSH
T1D1C1979DC4D8E802E204BA7079E39013168A27F345FD8199FEEA5C9E9F48BD4D6113A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll
Size 63KB
SHA256 c55e9c34f909aef3e70969a577927de726d260f27bbadd89e1c35de51afbab16
MD5 971433cb0345c02ff1454e664a88ac15
SHA1 634077ed2330739d85c7fd3c7c4b2d3983658747
SHA512 b9576574ace68dd6de6a6139a64aabf84f56183651b102a39143f364157139acb1d7e1e76fa2d6712e290b666b40949db1c42e43eeebad4a5d4848aaece5eda3
SSDEEP 1536:qeUisF9ifnyKkV+0b72KCTkmGPUsUAppM1hjw5:qjisfqyKkVF21TVGPUsRppUw5
TLSH
T189535C8263EC4212E5EF0F79A4F1B2114A79F6861AF6E74E1949C1ED0C267D0DE20F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.dll.manifest
Size 13KB
SHA256 e506197ca441d453580decf9963f40e65a3ad86552923c2d53c11a17a32741ff
MD5 72bc4947c7b1f5a1fef4b0c908ac1fba
SHA1 6da9b4126fcb0da1780cb7680a6612269a0926d7
SHA512 96b5c83440e54edd5b9dfd4cf0c698807eb4530f2b6e65a7121251c6947b46c6455d4ff1770056f476ba84f72bb0a6896d92ee18f64e8e189f2bdd18badf3f1f
SSDEEP 384:/yw5tUebz1qEr5M5Q92rbYQujSQxrjfTr+pWkL1YbybQ/bM:Kw5tUebz1qEr5M5Q92fYQKSQxrrWcY1l
TLSH
T112529312C4E8FE719B1712E17EE558214BCA5323959D1086F96D6E8FCF0C982478B2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeOutlook.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.vsto
Size 5KB
SHA256 20ae5f55bb60c85c2f03c49c4f9e74995d74d72fdf1da8984c356aac7e112db3
MD5 d329ede865f73ca67a7caa93909f51f1
SHA1 8ba70f617786387e907f86f842c66003c8b1c6ae
SHA512 baf76d3532c164d28bea468ce52fa22f344765f1223006a147af15a03012aef94b6b0873aa4982f2cb84d0905c364e82fd8f6f84243927b711d6da450edd02d1
SSDEEP 96:0WLwO9ZcsFHKdPkohSX2bcarmOTYaiECwuaCt2bcar86D2bca1bBDA:fvoy2b/+2bQm2bLA
TLSH
T1D8C1B79DC9CCFC01E205E9707AF19553658617B300EC40C9BEAB4E5FAB09ED1D6513EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 37KB
SHA256 50f4b03fe66cf18f47b0fb1aadfbd8ceacaff8750d225dcd3df34720f049002a
MD5 32f341c86521be429a70a99a6bd352b9
SHA1 2d2f1fa1c1d92b47e61193d958c52c0e3bcf12f6
SHA512 82870f98a9c61e18a88891b92ed9a22cae7d9cd8cb19aa096c09ced7618084634619365f9f84aa632b7291e1c03ae35596cf2f448788ab3a11d43f6e74338f0f
SSDEEP 768:bnzKq8s3JRHPSyyXT723OKr2R1fhTV+wG:bnP8+yXT6eqM1fewG
TLSH
T13E036C83ABE84103FB8F4BB8A8F5D6150D35F5CA2DE7D90F641DA05D29127C06B64B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 76777acebc061f0a2684d22a48fdab53547d9cd5a4064cca620a1c27a907075c
MD5 c4072784580e5e851f6aea59001b2a89
SHA1 229ee711a69cd6297a3c17457a6eb01ac0d6b88a
SHA512 9eef542762cb392a201bb0640fbe6cf5e586a14d0627e20a2f0815c4c934c57802191cea746b7cd7bac652b7743df0748e853f7465ea9553dcf4a70e2750a2a5
SSDEEP 384:Gyw5tUebz1qErM5Q92rbYQujSQxrjfWlkaRNI:dw5tUebz1qErM5Q92fYQKSQxrrclI
TLSH
T1F3528322C4E4EE71971752E17DE658220B9E432395CD1146F9AC6ECFCF0C9D24A872BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 8d8d91096c8b10a6071b3426f1267af5ffd710e4f6a8c46fe831ea6ce2803145
MD5 58fb920925cbe2a6e481ab92fce12c31
SHA1 f10fd6a2c0222498eca7dd66bc3d9bd7acdf00ad
SHA512 c9eb2e7b50f263b339a72652b59df30a0ef4e170311ae2727f8ff4a24694102811f0a169edb1477e3c45fce020b15ca2caa1d3a1e3aceb72d81f3af521d4fcb9
SSDEEP 96:0WLwO9Zc55HK9PkdbYxamOOVaiE+tVn+9aU2GoYbBDA:fWdbYq+aA
TLSH
T1F3C1A69DC8C8E801F201E96079F3D1036B8A27B340ED4159AEE95EDE8F49AD2C5113EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 37KB
SHA256 5ea5ace67da224ba517648b783a325b48a6174d8ee6569d46bc26a4cce84932a
MD5 fb7b6b81d0a43a8d320ae07190e3b087
SHA1 12caba8f885d51f31208e605631a97b8d476bde1
SHA512 23a1e266f229dbaf991619fe2af7c26cf45cbe73e14e910029bc0e60f813b03d10f1387f2d6f6d55b5cf9d65642348b32731124a34f49980eb610a05903b8510
SSDEEP 768:J00Lxxk4Di/+gkUplcg+Zr2R1ETTV+wza:J00jI2gkUwLFM1pwza
TLSH
T167035C43A7AC0113EB9B4B7978F5A5124974FAC65DF3D60E9416D09D2A027C06B60B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 3b7c3934776304e67ff5d4390de2ba5524da44ec3f5855bfc27dc648216eece1
MD5 fefce7d2cf51f6942931befbe9ff75ef
SHA1 c89947692d323498bc1d28922717ad364467b84e
SHA512 99e1eb9fe206e184b2b85a247b9f42f7b5a87517c7ca6a8acb132877e1cd3b2734cdde1b21c1d4870ab2713959815a460fee9ce1d828f29046d033d350820886
SSDEEP 384:5yw5tUebz1qErMm5Q92rbYQujSQxrjf2rkBbIHTZm:4w5tUebz1qErMm5Q92fYQKSQxrrKGMzM
TLSH
T1AA529562C0E8FE719B1752E13DE958220B9A433396CD104AF95D6A8ECF0C9D64B472B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto
Size 5KB
SHA256 742edadcd111f5c598740e279c70d543fedebad766054adf1e6e71b789154432
MD5 07ca2141e9ae6e530769cd7e8a959b9d
SHA1 9e3351a7ac2d8a156a8cbf8e836da1ff8ff7e849
SHA512 55ca877d22219f0423f238e78500138b6655c0ad8ce2b42a49276c4569c8dc2dd83b16a378e6631186c69575f5824083be6301134a771f7e48fbad82706baba2
SSDEEP 96:0WLwO9Zcz4HKRPkOM4kvaTEK4mO8H3aiEVt1ATEK43TSDTEKZo7bBDA:ffh4kvkJqracT6ZolA
TLSH
T1D3C194DDC9CCE802F305E9707EE28503128626B345EC419DBEA95E9E9F49AD4C5023F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.4MB
SHA256 0793d50b2243b90670759b9cf37d37e326cf4baf1a2974b09a2340b3c9c217e5
MD5 a02dcc91d3a511c6536397a5a0b3f88e
SHA1 ad364e747a611785ce02f75ade0ffd970a2c180a
SHA512 e4cf0ba5d101d4132978d0ef215772f378c33b7854bc4cc4198b070bbc529f89d30cb9f421e6b651eab9cde6932784c86f89ea3bc2d5ee0de9ba357abd74f8e6
SSDEEP 393216:pG6XmoXA8mOCU2UBzrFSfIz1q/zlOzHihNI0wc:pG6XmoQqn5c
TLSH
T109F68E6AB6A800E8D0BAC0BDCA5A5713F7B27C45037567DB079096B61F37AE05E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 230KB
SHA256 f58d1b78820c44f2e27efeaac7a739337dad2c740f24a3a4058dc8dd222cdea4
MD5 dc4f21742e43886b371db85981b9afa1
SHA1 46bbc59b7b673684bdde096778f9c69799d69490
SHA512 500eedb873b343ec997693a0eb4e9947e0382199393d47ad76c781f5ed35636a5418925eec2c94be74507555bc406c02b5315ffd29595d9e03c07865daa7e82e
SSDEEP 3072:4DlgMf07KkFc8MklfKcnyMUdsoyko7lVPm9d5Fr+OaKLErEPDjmjwP1X:4Dl7f0FMVDds5k6U92jQX
TLSH
T17A344C56A5AA007ADD66C538C9438D01FBB2FC4507A09FDB07810EBD9E5B7E0AE3D742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 187KB
SHA256 aa8e48c4d5f8e0b26e51c9a3e28d3f021c109f845ff42f197b5519e19b8a6eea
MD5 0fb295a4ef8ab21c5f987d504dd54594
SHA1 705b32de685cc4762018024cfbe83d508b679db5
SHA512 5a10faced67c8bffe3576f2be6168be80dd830d5180d908840ac8aae4a1ba6d0c341aeee1d267b9e172db7858ba52c5c6e0b59c206d2a438fcef9cc27494cde4
SSDEEP 3072:GJmOgbYVyiUrPyQlImdqPXtd4Kzl9qhZ7Yhiasul6s+9zo+JwHPJ:G4OgbYuPhJSdi89QLxo+JU
TLSH
T16C147C12B861D036DAAF09B45968DB629F3E6D51DBF095EB37800DBA5D203C4BF34B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 86KB
SHA256 9af58e4b434962f3411fa034a46619ca90e75445d31ae757f9ec61110229e5cc
MD5 ade8e3eba678471cd72dd3144b7ca427
SHA1 9e5a592fd36c98839fdb4a0a7a841e4a3ff71363
SHA512 a090b990d6ad4523b5dab808d146b64205da35ce51e220a4091aab022bd08aa773b58ee51684526d1d5650af124a17fc4f742b58cad99275d44b7470660de4d3
SSDEEP 768:YPv83Yq/0N6RvthIRU+F4kDBwwJhkHvAbtyVe+fSlKseIr2R19WTV+wCJ389zX1:IqsNivvIRU+FxDSwJtAgM19jwCJkzF
TLSH
T11C8306421A6500A3DE16C634C7B7EF27F672F5281F6217DF0A8689AC4ED6FD05E2B610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 73KB
SHA256 4456309f6d6ff9b8f284e49b3dc27d8db1bedb3116605a59d5105e6a10b6e489
MD5 acd2d9082b44bdf050535dfef32f0a9f
SHA1 020c76f91e685a0bfc904b1a33ffa9fb426babd8
SHA512 15da854d8385baf92a3a231d53235b9f987947029a04a2a22dbb25f24c4207e7518090299831afed38a560a02cc0efb3afbdd56bb6fb2e671ee8a76bf2dc7c09
SSDEEP 1536:0O5JvFtaJsM3k1NURVXkKM1HwWIPzvy+4:jPvLaHRVX9WwRPbyL
TLSH
T1EF733737690201F3FE9DD9BDF6A865321A7C97A1C3F750E7A5429ED408003EA7A27306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlp.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlp.dll
Size 816KB
SHA256 3ba5357618faf76f5079a036d3f5f269334cf552d9d931fc2097e25f0158d9c0
MD5 53f6bf23ce195563069cb651938f0a59
SHA1 ad4f7fdbe2f9edabdf035a4ce0695fd50200e9fa
SHA512 dd4cd523808d3ae9657553b184c16a6b9e100aa87043ae531aaadeec14ae20de7852308e00e3559e1a6ff94598659874a96b3f2364cae8f33df5305c3a9b9f45
SSDEEP 12288:Xm05yqtNSmHRTMcNxguWe4Q91YhKzvmhQhjq7ZF:Xm05dtEmR3Nxq3Q91YQzEQhjI
TLSH
T1FE055C3EA26C52B8E1B694B9C65B5902F6B1BC0253B45ACF03911A753FB7FF4163E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_hook_hlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_hook_hlpx86.dll
Size 684KB
SHA256 75e59a8405d935192ac8c8c8d828545a5aeceb9d40680a933dfef5b59622b579
MD5 5325c79159458b07661e104bf83fee8e
SHA1 e61f1a417bdd441fcf9b8604d94415256fc039f2
SHA512 11b516b4be48f0de260f4af7212ac3b6f729e0020243a624d9b0ff6c7b9e2913cb4c8e8b52ea8081a25d59ef59ddf393a39cb97623e39428f7938186e51cae2c
SSDEEP 12288:mwASHvX1dx+P7z073vLf02OZgemf7g+JT:mwAY9dx+P70LROZgemf7g+JT
TLSH
T1EAE47C327691C1B2E59E96F06128DB6A55BC64362B3129D7C7D06FAE4830EC0973EF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.4MB
SHA256 5a137b10aac9796ff1b2d5b8d24758dcc5b18b72aea9afea5fb2fa52cd9ab986
MD5 02ca08d641352e166f7add3f2a442ff7
SHA1 7bb64f743b4a224a755d3fd671848b2597e49abb
SHA512 906e10193f4052c9be77ba643b45e13fbf3474d6a3fe8f192d44dae342f0234cb49351e748bc9a75f60e1081fc69287204f5e0ef4b2d376790692bd206bce991
SSDEEP 24576:h/I0dayjhrDVTTRF+Be+fTcJclJ6tGmBG2OQ7abGtphB/OBH4OMlDH:1TjhrZT1UBe+fTcJclJ6tt7abGtpDOBc
TLSH
T190651B21232B2E63D6573378FBD31EA1A3346C4573566347729FA0250AE628CB2F7D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.1MB
SHA256 1513d7188d40255384b050c172ccfc0268625c9e9cade4a372d82519dd0b61e1
MD5 9a52e1b188961b429b54e318b83ff2d0
SHA1 d1a536a442fb33081114dc4f72545a0659fb3b85
SHA512 7bba8afc9c1cbc9c7635ba37ffbaad4c632f923364c20f8fc537cdb77e7438d8d63184dc2bacc0d53c9481a1d5778c11ef95f21a802a970260a3a52e02444b14
SSDEEP 49152:zGtlqhLVwASOybbGohEzkaLWICotftCE2cM3TJxT+zQmySTc1ifQQwdPPqSXDA9y:eEd2HjXTPmy0cNfUjdud+ecO
TLSH
T1C7469D69A5BC00D6D8BAC1B9C2865227D771B85547F057CF2A6086F61F23AE42FBF700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 3KB
SHA256 d01c5fd7f7e23265b3b819d31e76db93a9c5e58d0ee27df26087d26ba6cee9a0
MD5 d0dc4987166ded70001797f68667ec05
SHA1 0b9aaebaa11128e5ff39c6a5c4dd90d26c80ac22
SHA512 e8d8a5c648008870fa08f2a4efd4649fae69a69c3f8645b7c79a8f06969427a8a2da8d2a1845b16b66d9ef3d1019db4b88fa458261cc402ffdf6d601dc29dd6d
TLSH
T1C9810F587791867CF85A3210BF17384BB3A53190D0F8306136DE8485E3D6A9EC5B07FA
MD5 SHA1 SHA512 TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 244KB
SHA256 c5f18125d67e3308c58abfa6da14bb7e856926ae7d08140a4dd9660d31a1c2d5
MD5 954cc54987cff330509b4a7fc8f5a6e9
SHA1 271a2d9f12638b39ddc3dfd89118fc716000b28a
SHA512 2815b40fb3e9b29353c507e455bc49ecc2a136018a31d8794113df37c545dc244822890bbea8b84d32fad6b04ec0f7b7da285042607b41676722bef570a3f995
SSDEEP 6144:FAM7y6LUk6o/mEFjI0yFpktvGioozSqCjAd3pgZ:Fe6LBLmKBfs3
TLSH
T127347C16A39509F4E9678274E9B2C223DAF2B4452721C6DF02A4819C1F2BFD0F97DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 78KB
SHA256 933ffd8e7b26f6d93bdb9381176b25f8a1f4dde0fcd3f6d586720b97811a8989
MD5 dfc2fe152079783494472d460679178f
SHA1 c7f51f02316e59ef567451c6bbbfe6302f1e2a88
SHA512 644354ed4b7c7ca56c8d8367a782222209b808cf7be367200dfc22ba4e3f86b66639e4e44f60ee35600cfbe22275968510c2f010318b1f536cf2865ebeb726b3
SSDEEP 1536:qzrSh8OvYIKHNAnKalcVpFHZL1P0eM186wzfzBm:M/OwISAnKalcVpFHZL1P0e8wLQ
TLSH
T12173186233A80CA6CE1592348697ED12FAF3F509276146DF0296798C4DA77E07F3861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 68KB
SHA256 66bb33ab8b604d4b4ac93f92d3766b62b2e1bd648135d30a13bb20af38536f36
MD5 6edaeec0a172f9e649d2fdf4b418f1c7
SHA1 ab6c4cf4bd0f58494ec930baf3f9446f8a34e42e
SHA512 8ac309e6195957461fd15cd8a211b3fea2003ab4d679af2468c28d1e983daabb86d2b5e24c4ae1fcff266e859973a5f24935e37ecb77ab9465129b02e57b9b40
SSDEEP 1536:NqTkFCQ0U38jg3KqlslkFHZL11Yk5M1SwGWPzK:4k2jg3KqlslkFHZL11YGLwrPm
TLSH
T1FE6329D2BA1811B3EEEC5C71B6AC753299695A101BF684F36D583A888C07BDD7E34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 5KB
SHA256 1c3640a4524083b4d7bbbea94bb281f89f3291862d2b19ebe1f5e37c11e21c92
MD5 760aed0f9534108e1d118e45b1d86de2
SHA1 6dcddca699ad0c8705c94eac4415ae5492a1a2a0
SHA512 e150681800bc240c8858252d2c3d04dea970948d08aa3393e86bddda0b9088dfc62f8c09f35981cf885c4e58b4980a4c88e829426e03fb43427d288900c8f243
SSDEEP 96:PeSre7eJebeaereBAel2KRRe57Xr7s7S7G7h7e7qA7hP7g7b7o7EE7+7W73767HI:mH64aZqxlJgFHe0wNIl5qnyToALcbk1f
TLSH
T105B13DF6BBDE33703C0463815E173A6708E8DA6CFC7A149416A11C4C59C6917826FD7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 19KB
SHA256 b0307b650ac9afcc7059a3cc9010a8a28f10104c39496bc1e234c74c837e36f0
MD5 033d7e6bfab097d12b6f5340735e2e86
SHA1 5c76f43e843598ba7c77b594c1c29c7cbb2aa9ea
SHA512 72c2a54ccd05e4a0b24931a2f29547ec3ef08b2c1bad984ae440fc4333d85a71b2968e499ccf464a8874424e992e8e63099c4649275f53d25351f9f0dc6c6588
SSDEEP 192:mH64aZqxlJgFHe0wNIl5qnyToALcbk1hp0OQR3CANrlllylnlSlvlYTTRSpaRU+3:WjYl4dO8T92p34/cHZuAD
TLSH
T15F929BF4BB8FE3B03D1023D29B163E8609D4A80DF8BB28A277951E8D61D1917316DD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI987D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI987D.tmp
Size 5.5MB
SHA256 d449d11eb954c555d5839799d5689255a74fb5cc690a4004eb32ebc92e7ceb5b
MD5 fad8ff0eaa53da65e82b6dbec8da666b
SHA1 36b20109257a68a386482885746f62582e57a0a8
SHA512 ceca56a519e104ffe9d59af42d2cd2678971bef3cedf5b1054e70fc538b63c7d35e527a94f6188e32a23bafe65745fe587292b7a68bd2e62822132b5d42ad225
SSDEEP 98304:04aMcv0mE5u6VZE1j5Wc6bDGsc+pgzNWh7sX5aDaE6P6t:0ucTE5uQEWcjWh4MDa/P6t
TLSH
T1CA46BE22BA05C071D58D02B1757E9BBAC53D6838973449C7ABC01F7998211E37B3AF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e19720833ca1eb17a716b8a7e811aeaf4f644540bdb2a0415d8f24697fc599b
MD5 fc0fd7fa6588efd50eed97513790a0c3
SHA1 b72873655af4f099670e39130a715a38a96e9f45
SHA512 5c7e0f684768468feda13f5bbc55f2cdef44d692fa015aad83e13cf410cf00c458164b7e49af1238755c74862978e47433f4295271465489d9106ccdcb54d377
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ad41ec52b8da6913d5ffbb3ff89ef13357abe6cdeebc0a828548b124ad4844f4
MD5 e4fcb6525619f04b4a84e05c5dab56ce
SHA1 f916f048876ddc7d8970863f1e4807680a6592f4
SHA512 eee6ae6c76693a3a510e50c6d60e055a4d8364a68baeac960dfa612b1125e8b8347d70b88ba4ec2737daa5d850ce58e3ddadfdda20240821a5b3c7327dbb2360
TLSH
T19ED0121276118139D82070331102B10C0841C61F400642009428861D1F090540903492
MD5 SHA1 SHA512 TLSH

Submit Download

577c6c6b-450e-477e-9113-803d9457daee.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\577c6c6b-450e-477e-9113-803d9457daee.tmp
Size 6KB
SHA256 9b541d4ed62be0b2661294d9f2114537c8dc92be0c54f44eae74d7e2628841cf
MD5 2e04686f11c9a424bc2120b44ca6b6c6
SHA1 a6ef82fceb07d8e5e217bcd48cfd785ec1db9302
SHA512 4d044354d8550c9d14875439edcc675c69752bcf211f4394ded82cb3d3fae40515e5640a647f67c3a9761bc54ad8d9ada94c14c3869c7a429c392d7ceed5bf39
SSDEEP 96:stl/dyL3zb9FkRfo52D16ZZs7/x+6MhmuecmjenK+glFP28XM1C7jL:stZAPqfonsV+FijdLNG6v
TLSH
T15ED195015E68797B4CC6F119FA397A43E2F9603271E51E68EBF88A1C06DB5CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a76b8.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State~RFe5a76b8.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 2KB
SHA256 9ced55c957cdd9b3b262b30657e725877b97666359e74d2d04346d040e194bd6
MD5 cd2cea21d24bc8d3618aff995e00fa6c
SHA1 06127f788becb3a5f1e6bb45fe7068d38765c824
SHA512 898bab37548581544a43f6673d577277be423b6df688006feefacefa51c6e58015a7dfe7db850138ce3d6b43a403b11c0d242efd8a2a36c5cb3ea51b4a2b5563
TLSH
T1C951A7737C246A3789F39A047A5E3F239E6951A59B622F2499DD1F0C03CB11C5306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 3KB
SHA256 ae1933b3b37b8181b691c145b41efecdb1601d6a4d3c4b4918878c235342a7ef
MD5 d510baa8918497e609029da48fc235e9
SHA1 2b18770104c080926aeefa4b81db47d91b0667bf
SHA512 e6b98262e6f3dc34bca9f700e58e15c97052261c647f6a3f9ddbd115cc688162e6a186fd04caa0319b1af0e7abbeb1288d71a6d5c8bd36353699b93e0437f723
TLSH
T1356194376D74A93B4DF3DA04B98A2F17ABA55027E5923F68C5EC1F0C02DB2881342D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 15KB
SHA256 306e54a21cb682c18b91556a030d0381c96fff2160e28a656035e0be0236d05f
MD5 1b4137ec88a916c0649f6ab2e3de5cb2
SHA1 923fa3d4adc02bfdd2c091dc44bc793fec615ea1
SHA512 f75b6dfed0ced4791f0fb23c19e36f0922ba737707f924c7abcf20cb63bf28638cb0a7d0fb0386878417336dac04106f8378031ff4bd4c0673b922e906ff792d
SSDEEP 384:O+aQikB+z/xvxjg/qhEwNBSUVR36ed6/+9zF:Z/UxvxjgC+MPKm6/+FF
TLSH
T12672AF2B95797E2395F3E9057A5D0B4BCEB994B291C22EBC49ED6F0C07C73980301D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a4c5c.TMP

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State~RFe5a4c5c.TMP
Size 1KB
SHA256 edf34d1d16fffca1dd9b2a12716918f4fd901f580a50d9f31f03dac99d3ec7b8
MD5 333f031de2646b1548ab356d180b0604
SHA1 a37226ac85642511586a1854a06fe1cb7ffa3201
SHA512 b1f08c8e0f86ba21518c44a5477e2c7e4f78a3d8f8d0e356cf3cf558b2d8c324a6c3f3e894318eb709fe41fedd29707b4331bfee4d3d79bbcc8094d44a324073
TLSH
T16E2168B2E9681F339DD2A645225EBF576D54406E83624E0455DE8F0C03DB14CD61E937
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 9KB
SHA256 d44e59bc861a58467d04ea92b9b3e76a724cfe9b908d0074333081232fbc9036
MD5 364f3ed1795ff140acc51712527f5c97
SHA1 67b5315c05f4613b4ab434c89f72f6410f23e2d8
SHA512 4a113c1c670fbfabccf05154eba6e0f7316a69a9be72435d84e9f95459da47a3cc96b06113e670a9bcc0e420a41340a4deecb792c22fd5978af58bf8eeece1ef
SSDEEP 192:2qFdYIFnIZaWVJSkZ1BZb/SqUDF3DoDkDPD4DvDsUDMDAzDuhDFZDgDv1DyZ8XDS:M/CBjuIZPsbB3dRNRmPnDPqo
TLSH
T1E122BC821C0E15AB65140CBBF7894BAF0D87EA8DBD1ED854B2741548BE0812DD32EFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 1KB
SHA256 78ccd0929ebd06594e38062837d99cff76023d6f993a696ceb4796ad94bae445
MD5 054dcf409f18f93048f63a7f23db1902
SHA1 a70d2723367323e6e48a2ee0e1f9b606f00923f2
SHA512 70d4a8d4be68bffdba30cf04ae9e702616c5e1eacb18e7cce2d20af9e93f9c06740cfecab0f7dc0b290c4035a58dfa39fab1504b830d015ab845576645307ce2
TLSH
T1B5312822524B207D3E033B5FE3539C26C582788A976D53B166EF5106DF04D9C616AC6B
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 3KB
SHA256 f913bcb14634603dd8099f43d43a63091345764f2229657c3d133be73f6075bb
MD5 3d93d57d2f8a3d464e8913efdec5d09a
SHA1 8f7358a6f722f21ecca8283fb81ecdf78a1160a0
SHA512 c9c7c95c918bd9495949db3a975bdf031fcefdc0b7e1f9b1769d2b53f6f7b1260f0672252f8446da7289bde2acac11b8aa66813bc11f8fac2dd3d83a7c1b47b3
TLSH
T1F881AC31874B54BE3E132A4FE74398374942A54A975E42B177FF324ADB08D68216EC73
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 12KB
SHA256 a41dafd8714f061e1fd97bbf0ac322945e041aaa107ddd24fcb8a7c6411fa64b
MD5 0adb90ab54fff5ce12d8b4a7df724f63
SHA1 c75c6ed29b0e7719c8d2cbf71ff29d9dbe45a0ec
SHA512 4254a22ce888e68ae3b92d0705613e936c2d0d7ebbd75a5925bc748629fb1c98767a82649a8a029d9da6b226f745a74097c401f7663c7240d35852c3d264d634
SSDEEP 192:2d2RwpwYtwYsYpY4jge8LhXgMaFxcB3T8vQfTbLbPHVKT5YBs/pl1M3ZJGhup3JG:8Jmh3dPv7p2WGAxbzCPD7cxK
TLSH
T193420331464F54BE3A13290FD787983B0D43B54A97AA81A173BE324BEB48C7465ADC73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI237D.tmp

Path C:\Windows\Installer\MSI237D.tmp
Size 571KB
SHA256 2b3aaa5f6e352acc503810ca71d6f33c9f9db317b6c3a8b65f2fb57abba04ccc
MD5 52420c9e7c5eaafea49dda57f29e3546
SHA1 7362636084f5306fb0258c2708101bcc16269fc5
SHA512 bc1429fba0d08e97dd72e101596b81381b276fafe4e675e2795c182faf5a845db3735bc96b6cd347c4183b9e91c46824fe99e7841d55285b22c14e7db1e08771
SSDEEP 12288:nVJpggTxyuSCErtpWU4hhCkph0lhSMXlAlRDmjh:nVL1VzK3W3rC6h0lhSMXl+C
TLSH
T1B8C4BF19B3E542B9E1ABC174CD930926EA737C444361ABDF03919AA21F237D15B3FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 fb1887be50dfa15d61467a4d47b0a6ea36cdc9a7dccb662b50936cd033211373
MD5 4149893120b63728aad714890cef03e3
SHA1 1d608d58d12faa5597636223b8a624cc6e86820b
SHA512 8341b3287bea2e51d29e703475287cfca21394a357aba98f11553a7d557c47e13e044611899e8fb45f2e15a7a9d02c4559ae7e8c898193d9da40acac39af67b0
SSDEEP 24576:qFo3DMP+doO/vvTL/yAQQiVQfL+a77XDkNmSdNe4mlea53hg8YxWA5KRE+e:9HM
TLSH
T12957E42436F92111E7F79E3CA8F06A274D397D979C19DE8D05811B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a4468356-179a-4abf-a1c0-2395907c5444}_OnDiskSnapshotProp

Path \??\Volume{c4492839-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a4468356-179a-4abf-a1c0-2395907c5444}_OnDiskSnapshotProp
Size 6KB
SHA256 6ed1304de861b5cd1f06ba8de7e07a253da415cfd033b02393945c48df377dec
MD5 803cc13734ea32b2607c46c3feb0c4b8
SHA1 9da6a1a775a91be6563abba157f4328bee614080
SHA512 29c9ed8f3c7f30948d6dae355d8a676e3ac69c04cbd41bf802cca5315fcca3801e8a618fd1c786735e13f68e9997e67d0b4bec88c3674d06bf8e977341f20fed
SSDEEP 96:FCrFcxvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Areb++uVm
TLSH
T18BD188085AF54711E2F3AB3129F18557A837B811EF33CB8E0198638E6621A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3116-1133-0x00007FF9A33C0000-0x00007FF9A33C1000-memory.dmp

Download

memory/3116-1134-0x00007FF9A4980000-0x00007FF9A4981000-memory.dmp

Download

memory/5844-1092-0x0000000000F20000-0x000000000163F000-memory.dmp

Download

memory/5844-1094-0x00000000727D0000-0x000000007299F000-memory.dmp

Download

memory/5844-1093-0x00000000729A0000-0x0000000072D55000-memory.dmp

Download

memory/6736-565-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download

memory/7088-614-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download