b1cd63600ff2ccdcb62129554559dd351c5ec197bcc54180a6c4d57d04f1e26e

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NSClient.msi
Size 45.3MB
Sample261020-pz7dmsbe44
SHA256 b1cd63600ff2ccdcb62129554559dd351c5ec197bcc54180a6c4d57d04f1e26e
MD5 6f452c80806d3b2d58fa2ca67dbdf1ba
SHA1 5073be562179e2568e4028b1ac06661e118ed444
SHA512 094451e25dfc1fd52b2bc486fc4a7df60cdf9fc030cc5b25ac797518b455c76d177b5ccb7eb34dc739fdd25a338f73dd398a4fe2806e08a35baaae143e355b86
SSDEEP 786432:w9ZoFxMNqlLPZVc8seS18SrX3nXFto/wB6a/Xjj8LuQMG7Eu29wU9KhMp6FN4WHq:wfoFxjRPZOK9eX3XFeYBFoAGguy8MQdH
TLSH
T10FA72311FA01C031D9AE01B5E57A5BFA89786C20D33445D7E3C03EB9BA716D27B3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\stAgentUI = "\"C:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe\""	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4820	msiexec.exe
6	4820	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	stAgentUI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker32.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat32.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlparm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpdrv.inf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopePowerpoint.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx64ipc.dll	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\7zip.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_printer_integration.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobatBroker.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperarm64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperarm64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_text_extractor_arm64.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\resource\nsuistring-de.json	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\license.rtf	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_browserhelperx64.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_text_extractor.exe	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat.api	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperarm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_printer_integration_x86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\fips\openssl.cnf	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\tramp32.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlpx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.vsto	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeAcrobat32.api	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeOutlook.vsto	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv_arm64.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\win10\stadrv6x64.sys	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll.manifest	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\chromehelper.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobat.api	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperarm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx32ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nstls.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp_copyhelperx86.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeExcel.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.vsto	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64ipc.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\STAgent\nsV2CPx32.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\DEM\demAgentSvc.exe	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.dll	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeOutlook.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlp-collect.exe	MsiExec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeAcrobatBroker.exe	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll	msiexec.exe
File created	C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.vsto	msiexec.exe
File created	C:\Program Files\Netskope\EPDLP\win\NetskopeWord.dll.manifest	MsiExec.exe
File created	C:\Program Files\Netskope\EPDLP\win\epdlparm64ipc.dll	MsiExec.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI529.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\LICENSE	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI1AD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83B8682C8239AEDD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18CA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_1390259500\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59c366.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID53A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID307.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI184C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6170.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55634D87837EFF6C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_1390259500\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSID943.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFB8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E8FF814C6D7E10D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI131A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC51A8BFC198E80F1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_1390259500\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_1390259500\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{CA249397-FA28-4B77-B259-16D8F053442D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F89.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c366.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7CB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\_metadata\verified_contents.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSID8A6.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	stAgentUI.exe
2652	stadrv6x64.sys

Loads dropped DLL 21 IoCs

pid	Process
2968	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
2644	MsiExec.exe
3368	MsiExec.exe
3368	MsiExec.exe
2644	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
4712	MsiExec.exe
1352	MsiExec.exe
2656	stAgentUI.exe
1352	MsiExec.exe
1352	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stAgentUI.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4820	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	stAgentUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	stAgentUI.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stAgentUI.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0b4c806e3f937b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ee0b4c800000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ee0b4c80000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ee0b4c8000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ee0b4c8000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{804c0bee-0000-0000-0000-d08302000000}\MaxCapacity = "94852"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{804c0bee-0000-0000-0000-d08302000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{804c0bee-0000-0000-0000-d08302000000}\NukeOnDelete = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	MsiExec.exe
4712	MsiExec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4756	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	2660	msiexec.exe
Token: SeCreateTokenPrivilege	4820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4820	msiexec.exe
Token: SeLockMemoryPrivilege	4820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4820	msiexec.exe
Token: SeMachineAccountPrivilege	4820	msiexec.exe
Token: SeTcbPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeLoadDriverPrivilege	4820	msiexec.exe
Token: SeSystemProfilePrivilege	4820	msiexec.exe
Token: SeSystemtimePrivilege	4820	msiexec.exe
Token: SeProfSingleProcessPrivilege	4820	msiexec.exe
Token: SeIncBasePriorityPrivilege	4820	msiexec.exe
Token: SeCreatePagefilePrivilege	4820	msiexec.exe
Token: SeCreatePermanentPrivilege	4820	msiexec.exe
Token: SeBackupPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeShutdownPrivilege	4820	msiexec.exe
Token: SeDebugPrivilege	4820	msiexec.exe
Token: SeAuditPrivilege	4820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4820	msiexec.exe
Token: SeChangeNotifyPrivilege	4820	msiexec.exe
Token: SeRemoteShutdownPrivilege	4820	msiexec.exe
Token: SeUndockPrivilege	4820	msiexec.exe
Token: SeSyncAgentPrivilege	4820	msiexec.exe
Token: SeEnableDelegationPrivilege	4820	msiexec.exe
Token: SeManageVolumePrivilege	4820	msiexec.exe
Token: SeImpersonatePrivilege	4820	msiexec.exe
Token: SeCreateGlobalPrivilege	4820	msiexec.exe
Token: SeCreateTokenPrivilege	4820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4820	msiexec.exe
Token: SeLockMemoryPrivilege	4820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4820	msiexec.exe
Token: SeMachineAccountPrivilege	4820	msiexec.exe
Token: SeTcbPrivilege	4820	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeTakeOwnershipPrivilege	4820	msiexec.exe
Token: SeLoadDriverPrivilege	4820	msiexec.exe
Token: SeSystemProfilePrivilege	4820	msiexec.exe
Token: SeSystemtimePrivilege	4820	msiexec.exe
Token: SeProfSingleProcessPrivilege	4820	msiexec.exe
Token: SeIncBasePriorityPrivilege	4820	msiexec.exe
Token: SeCreatePagefilePrivilege	4820	msiexec.exe
Token: SeCreatePermanentPrivilege	4820	msiexec.exe
Token: SeBackupPrivilege	4820	msiexec.exe
Token: SeRestorePrivilege	4820	msiexec.exe
Token: SeShutdownPrivilege	4820	msiexec.exe
Token: SeDebugPrivilege	4820	msiexec.exe
Token: SeAuditPrivilege	4820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4820	msiexec.exe
Token: SeChangeNotifyPrivilege	4820	msiexec.exe
Token: SeRemoteShutdownPrivilege	4820	msiexec.exe
Token: SeUndockPrivilege	4820	msiexec.exe
Token: SeSyncAgentPrivilege	4820	msiexec.exe
Token: SeEnableDelegationPrivilege	4820	msiexec.exe
Token: SeManageVolumePrivilege	4820	msiexec.exe
Token: SeImpersonatePrivilege	4820	msiexec.exe
Token: SeCreateGlobalPrivilege	4820	msiexec.exe
Token: SeCreateTokenPrivilege	4820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4820	msiexec.exe
Token: SeLockMemoryPrivilege	4820	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4820	msiexec.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
4820	msiexec.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe
2656	stAgentUI.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4820	msiexec.exe
2660	msiexec.exe
2968	MsiExec.exe
2644	MsiExec.exe
3368	MsiExec.exe
4712	MsiExec.exe
1352	MsiExec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2968	2660	msiexec.exe	90
PID 2660 wrote to memory of 3556	2660	msiexec.exe	95
PID 2660 wrote to memory of 2644	2660	msiexec.exe	97
PID 2660 wrote to memory of 3368	2660	msiexec.exe	100
PID 2660 wrote to memory of 4712	2660	msiexec.exe	101
PID 2660 wrote to memory of 1352	2660	msiexec.exe	102
PID 2656 wrote to memory of 4756	2656	stAgentUI.exe	107
PID 4756 wrote to memory of 5668	4756	msedgewebview2.exe	108
PID 4756 wrote to memory of 5056	4756	msedgewebview2.exe	109
PID 4756 wrote to memory of 5056	4756	msedgewebview2.exe	109
PID 4756 wrote to memory of 5056	4756	msedgewebview2.exe	109
PID 4756 wrote to memory of 5056	4756	msedgewebview2.exe	109
PID 4756 wrote to memory of 548	4756	msedgewebview2.exe	110
PID 4756 wrote to memory of 2216	4756	msedgewebview2.exe	111
PID 4756 wrote to memory of 2216	4756	msedgewebview2.exe	111
PID 4756 wrote to memory of 2216	4756	msedgewebview2.exe	111
PID 4756 wrote to memory of 5560	4756	msedgewebview2.exe	112
PID 4756 wrote to memory of 5560	4756	msedgewebview2.exe	112
PID 4756 wrote to memory of 5560	4756	msedgewebview2.exe	112
PID 4756 wrote to memory of 5560	4756	msedgewebview2.exe	112
PID 4756 wrote to memory of 5560	4756	msedgewebview2.exe	112
PID 4756 wrote to memory of 564	4756	msedgewebview2.exe	116
PID 4756 wrote to memory of 564	4756	msedgewebview2.exe	116
PID 4756 wrote to memory of 564	4756	msedgewebview2.exe	116
PID 4756 wrote to memory of 3268	4756	msedgewebview2.exe	117
PID 4756 wrote to memory of 3268	4756	msedgewebview2.exe	117
PID 4756 wrote to memory of 3268	4756	msedgewebview2.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NSClient.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4820

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 67E42B5D64F3C1813F3ACA4361CB79D7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2968
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB821104C5B6769AFB8307988C1C04D2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AF373A5F607CDB2C69E09307BD6B40CA
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3368
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3E53987260AC236C00EF1B2D1029F862 E Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4712
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BE97F9DB938E1AB019EE3C9CF5B3747 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4544

C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe
"C:\Program Files (x86)\Netskope\STAgent\stAgentUI.exe"
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --mojo-named-platform-channel-pipe=2656.3332.1556254543740384201 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView /prefetch:4 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb5c205fd8,0x7ffb5c205fe4,0x7ffb5c205ff0
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:2 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:3 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3284 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2 /prefetch:1
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView" --webview-exe-name=stAgentUI.exe --webview-exe-version=142.0.0.2821 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1760,i,10836298233316617756,4192023895193930740,262144 --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared --variations-seed-version /prefetch:8 /pfhostedapp:6044bd3a1a51df56f5fba11cabc7b44f559472c2
    3⤵
    PID:3268

C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
C:\PROGRA~2\Netskope\STAgent\win10\stadrv6x64.sys
1⤵
- Executes dropped EXE
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c367.rbs

Path C:\Config.Msi\e59c367.rbs
Size 13.0MB
SHA256 87fd1fcf6ab3c3b22a18f994e0af0a9ce02d24aa4d175fb8ef0ab6e777ded4da
MD5 53c5e94326f05548f48bcf4ae7ebf0ae
SHA1 a2acb63867fc980b562033d83d0b33c989ddaf60
SHA512 31baed988bccc4ae64e109bded5d9bd89e52dac7ee83546bba56834d90bbf245fa9586b8283cdebadeb5b1a427dcb27a1cb4b05488e9b4e977d4dca6a1798801
SSDEEP 196608:6AXtSzT28iEWkhqokKXQyGEt2QQmWLAXtSzT28iEWkhqokKXQyGEt2QQmWV:6A9ZJEWokKgyv25BA9ZJEWokKgyv25b
TLSH
T196D6AE12FA01C071D8DD01F521BEABBA897C5D30973445C7E7C02EB99A615D27E3AF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\license.rtf
Size 222B
SHA256 d6ced400ebf0c4f458322ed7a38574ecb14320b1a0d6a67c3987ec2745440848
MD5 2529075993fd85fb19f52ad8f84a54d1
SHA1 a1cbfbc027527624ab84804487556ab3742aed72
SHA512 c0d37012bda1e53049ab751242ae76c1f5f3c318f057dc91bba18f7e6770d961b15cdacdb31a902636c72e8471b861bc12bc23057d5f78ccb6c51efeab47b4f6
TLSH
T121D0A775618294912934339298A15014560652C3F8BBB4CD66931F557DA3878B314668
MD5 SHA1 SHA512 TLSH

Submit Download

7zip.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\7zip.dll
Size 1.9MB
SHA256 5307a63cd17ed1f47be6e40360688d4ceb9048d7a75b0f8ca9b36960d1abf61a
MD5 6827c149948764091ff61036fc67cde2
SHA1 1e36a88cb0edfe698bc9c8fe0fce49948b6de688
SHA512 cab9c6d55e815a012394e31bd8aeb33e782fb1bc6d929ddc588f728747b592d644e8a82381f636cf4542f2a5c3297a71c6939f53385e99f1159efeb9a48017fd
SSDEEP 24576:I3EJ6ltM2Hmz4pvIOwNZjHO/TCDCq5rffsI7MH8YPQ9F9MmZzibqZR:I3EJ6lxmzWvIOijHKmHJMjg7M3uv
TLSH
T1ED955C5BF67540E8D0A6C034C62B671BE6B1745A8370A7EF12D09A6E2F13BF1993D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Common.v4.0.Utilities.dll
Size 39KB
SHA256 b26229eab6c559516c01b89d54c02ddaa8dfab8a0907e206cbaaa473ab4200c3
MD5 4ad84c23d6cc01d3c1b102dbb438d43c
SHA1 f3c0ef3092e9e4a1c2e9a84ab0f3960d5cc81cd3
SHA512 b65bf5f59a729649e4ecda425757bbf0224c68f9e653fb3351544b1f4b795eb487710126195783ac6f932ab495d93c5262bddb89fe94de1d1ab878c6099a77c9
SSDEEP 384:sWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/Tj3:hwJTwYB4E5n/xe5arvur2R1dKTV+wq
TLSH
T14E032B0286BD8323DA995E34FDD0B8516BFCF7C379EAD60F500AD1A648963C19A90D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\Microsoft.Office.Tools.Outlook.v4.0.Utilities.dll
Size 47KB
SHA256 018f5fe2880c5419cda8d2af19cd0aa3c5375ec20378b854fdce63932ef1d997
MD5 475f329e73357d2ec0a76edf181a3f73
SHA1 6762ccc2e6fab8961c48dd5591432126bff3754f
SHA512 d6093f890a770bb4bb1050cf024127c7935faa2c5f8a0fa3f5611ec123b3fd92b192c616abb68395414179557fcaf00c8e4e82c6822c30fee337daf4fcf95e8c
SSDEEP 768:P7vV5z3+6KTqUPtLnPDiQ0fWST41mocNAwkEGjhl2BOBaBnD/4xFsOjMi2jXHU1d:TVs6c3dQ9rHUcE
TLSH
T11D23A681C019F261E80D983435B0FA81F6BEB7D72FE9F64E9212FEF44052359E194E99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll
Size 40KB
SHA256 706107f1b21e1cbc883fbf7853e59140f0fe329b6d35e515b6f37a54d7d1f580
MD5 a3120a8df6418bcddd4c4196e1d7a14d
SHA1 5618e3e7a32c17e13075dd827f6871b3b041c038
SHA512 8cd3380acf4f1d0e4f6ba17639d1187e76637a0107e50ef0b480ab00496af4e877df776605d1274276a1988ecb4fed335fed664a57eb0f1af7bf2f1d59563ce7
SSDEEP 768:4g+xcZZ4IjnGIuQLWjed74zjcAhur2R1ETV+wrh:PjZ4IjGTji74zneM1Jwrh
TLSH
T1EE135B83A7FC4603EBDB4B79ACF5F6110938FA861DE2D61F9406909E18527C09B70B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.dll.manifest
Size 13KB
SHA256 663b0f32cfdbb4bf6354bb9ced2d99733365e858c23daa8582c3182677f149d0
MD5 7a7d6f59f056561a405061867f8d0b5e
SHA1 2f8969497dfe6a1ab504c29872cc9194e44681e3
SHA512 bcf435082d03965737bec3e14bd5aaba82e444c3cbaf25253675d00b5bd4fef61e37106fad709bc13724b71a78209c1ceab4d7fb86e53cc01c298319bd7d696f
SSDEEP 384:Qyw5tUebz1qErhM5Q92rbYQujSQxrRjfAZkSjal:jw5tUebz1qErhM5Q92fYQKSQxrRr6Sl
TLSH
T183528422C4E8FE719B1712E13EE658210B9A5333969D1046F5AD798FCF0C9C60B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeExcel.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeExcel.vsto
Size 5KB
SHA256 28b520e37ee399fcfd74fdcbea8a02579ecb01c668ac55b1e05f6628fa8daf04
MD5 170d8d3889f3b20ce42d143b6ee17239
SHA1 fb417fec663c22bbd06ed25d6984b06fe2b988ea
SHA512 3aba58698a176c25be8704e26af6e0376ee431a5aecbec7d771756cc0b6764f641bdaaafc484e8e7e967ac43035b09c6fc902bcb86b703e5517211d90c71172b
SSDEEP 96:0WLwO9Zc/BHKgPknWtlLmO6wLxzaiEyGULaXsbBDA:fTnWKJWA
TLSH
T1D2C1B89DC8DCF801E204E9B07EF2C503164927B342FC4099BE691D9E9F49AD8D6113F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll
Size 37KB
SHA256 a1f17d679449eca6fcb6c4b7f0fdd4fa874a82edf14ae49e3e7485bc2963d3af
MD5 9cf62bfddd6825e13e35db83a1b54563
SHA1 9c1d8ca82b0abba0a66e2cfbd651366498b8b45e
SHA512 1421c5bf785901ef9469ec0ed5b3fddb169d2994dea0779a46be58eaab4d58d8fe3078f93a069123b223f535c78e281ffec4d6a33b162282aff57ac9fcb93e56
SSDEEP 384:8n3Dfiqa1b38zL353hff0akrcrD+wOzzpmOfnlVfcXB2mFuoZgWSt/uo6ki2Ki1z:8nzKq8s3JRHPUyyXT703usr2R1RTV+wj
TLSH
T105035C83ABE88103FB8F4BB8ACF5D6114D35F5CA2DE6D90F641D605D29127C06B64B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.dll.manifest
Size 12KB
SHA256 c693d0299eb01e813bcbc85e348c0e2986c7b419f8dc6a5cdd92b222d8f0a7a4
MD5 dadbe3c011a330bffd5f1fa8da4dd1e7
SHA1 5b012c041d0793443ebc9ad0c3e3dfa99beb6ce9
SHA512 87c835f9eef26866842a596521524997e27d4872314a4e4a5141669efab83977082bf4ecea9715ea07f9961ed1f16ef38d4f36dc1be9e19c7d003d1cd168f629
SSDEEP 384:Syw5tUebz1qErM5Q92rbYQujSQxrjf/okKHkkeqid5q:pw5tUebz1qErM5Q92fYQKSQxrrwj2dI
TLSH
T1CE528322C4E4EA71971752F27DE658220B9E433395CD1046F9AD6E9ECF0C9C20A872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopePowerpoint.vsto

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopePowerpoint.vsto
Size 5KB
SHA256 197c7f0dc60b3792eefa5b5ac0309894fc214a5e7ed9449933bdd8d549237c91
MD5 b63165297c72032a16b5d888d2373db8
SHA1 f3fa5364e5284d9ea83aa8c4350e402b7472ee11
SHA512 6234c7cb547517c65fcc3b1221ac5de933250054b0010bd8dd125266f5c193a6aef0920681328870de1de33eae110a29111d351b9d39b0e8f40d4c63dd2bfad9
SSDEEP 96:0WLwO9Zcd5HKhPk7OvkFZXmIrmODhaiE+R+FXmIr+idlXmI/bBDA:fW7Ovk7XHDCXHKid5HxA
TLSH
T10FC1B6AEC8C4E811F201EA717DF3D1031AD923B380EC5199BFAA5D5E9F65AC1D1113EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll
Size 37KB
SHA256 8b883103efff4d03d310c7d42fd3f7cd9ab39463aad3e46e1db91d4c5d487120
MD5 7226af2195840e66ebcac45dcee397cd
SHA1 80913b747134ce4e4a3c30bdf27fd4450b4b3674
SHA512 20218f33c74083d3e94e77564be6ae6e6587d4bc4d77c50bfef4ca72a86b7b1977e277f46d034b3df1b21dcac1dae4e7816454bc9124409b356750d15176d8e6
SSDEEP 384:s00Kux6wkT4Fc8dzddmvnnsCPBZszCJ0KpT71+Y/m16/gu1Xb/uo6ki2Ki1uIgsZ:s00Lxxk4Di/sgkUpl3g6Sr2R134TV+wy
TLSH
T11C035C47A3BC0113FB9B4B7578F5A6124974FAC61DF3D60E9416D0AE2A027C06B60B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetskopeWord.dll.manifest

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\NetskopeWord.dll.manifest
Size 13KB
SHA256 74f12a9db32008888ef15242cbdcf42c235a567b426b6c0761387011b1e45791
MD5 c07d9c4b936d03f9e003e8ecbd0aa941
SHA1 0344de13b62bb842d46222cd60d862a4dccdd8fb
SHA512 ba1b2ae3b3aeadde0968fd79587a3f47bbc21401bb68a58de4fafb032b717ce78d16b9502f24753837e598f442580dbaf84f86be14c61c95fb0968d5f821fa8b
SSDEEP 384:4yw5tUebz1qErMm5Q92rbYQujSQxrjffDkdyDlEm8:rw5tUebz1qErMm5Q92fYQKSQxrrbWyDs
TLSH
T14E52B622C4E8FE71972752E17DE658210B9E0323959E1046F9AC698FCF0C9D74B872B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp.exe
Size 15.9MB
SHA256 b21cf690aa4ce057d168e7a653434f8a0429e1f605dc420f0ef2754c82fec2fa
MD5 9e83d95712b0698385accaf71c40f95f
SHA1 deace831a8b8d9c5d73383b68f6e7d9d9a5b484d
SHA512 31368477eec131bc7d04deea384cc4348c68f32cbe3d02491b2629b16a3e01fa18759388c4ccf6f8aae0fabb68fb420838740d453b6a12e3728958a3cb224501
SSDEEP 393216:knPsfcgcaIYkobRXNIaYAVr64d9lioQ9Dyhhb:4sfcNkWe3b
TLSH
T131F6AF7A76A801D8D0B6C1BDCB4A5613F7B2BC49037467DF06A096A61F37AE45E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx64.dll
Size 239KB
SHA256 92d7d86ddc1ede77592af5896d3f85cba35e97901413e446ad709cb2db7a6a5f
MD5 1a9bd8517b6c9397c6faa84317adcf69
SHA1 599855c9e9b3ec3a2a174d1b2c59caf830b0036f
SHA512 6427192a7076b9d249f5f22cd291a3ad26680cc41f8c8fa301943b78decfbfd15784416c0f5ddab1945e4020c0e337e22de7448957604f45a614463df44722b0
SSDEEP 6144:A9QuwZXpMz0T0MjbZUQZxS9WdA+PdlPazCPE:A9QZv+0T1jbaQZxtdH7E
TLSH
T14F345B16B56500BAED66C134C9838D01FBB6F84507A0DBDB17594EADCEAB7E09E3C309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_browserhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_browserhelperx86.dll
Size 195KB
SHA256 db407bb1e6a2e41c3bfec56488ec2847b24b7c69287e2251da5eb5e5a2cf1f04
MD5 19cfd424f551f2f22eb9a1ceb3593c76
SHA1 1426003ddeef60420dbd40827acda272988d783b
SHA512 eaf37169f6be3705a3733a83f09739a52400a950654a4d4a678fdf742d6c74a780cc63e401ac9070364e4f95d0fb35bea6bd4c615d7d052a890727f31a16e14f
SSDEEP 3072:CJmVzC6GMvC0f33Cr2iptdXLNxWTQy77mqvga1/PjxysOz+Bwlx:CJazC61L3wrFhxSQwNXlysOz+BK
TLSH
T140148D12B861D036DBAF19B0557499629F7EAE708FF4A4DB7F440DFA09212C06F38B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx64.dll
Size 87KB
SHA256 56d9234c8ffcd36a6fdb6243517224f516ef5d82d278fc3068b3c54e7d05b6ce
MD5 3084a8aea413420400a693f6d67265ec
SHA1 19194534cf3c9eecfada9155fa05ed9f3dca1982
SHA512 7bc1d7bf93f94be847bcdcb6c2b981e3ee40e5407144f9963fdd51c4e360603e04258fde2476d4eeae13932c22d389d852c38a57b9c82885584d942e7542ba06
SSDEEP 1536:CGP155RAGVDZqpKKtdla+YS4LOM15w6FzVN:755RVZPKlaxBO8wSr
TLSH
T116932752127400A6DE268634CDA7EC17FABDF808136237EF05FE899CDED6BD01E29614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_copyhelperx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_copyhelperx86.dll
Size 75KB
SHA256 16a2a81d05aa82c6b7c40aae8d14a4c147d23ea8bfd5cda6e10433726c208497
MD5 ff4b47442a9952f16bad0381358b5602
SHA1 1816f666bf00e31f57567e83325877a5ea1b2d0c
SHA512 be65b6715a32335ddbf6389fe5ee25130a265021caf5b47c730c72efdac32031dccebf417f974bc7fe2e1aef41019232f71b08901ceff8b903be33d683e417bc
SSDEEP 768:I1kU+4UxT2wSFXMOo0+StuyWqOEw1WMikKK2mvBNkNr2R13ElYTV+wEkq3cC9z5N:YeSFTqS7OVC9KvBNkJM1U9wO5zL
TLSH
T1D27339972A1418B6EADD9DF1F6FCE52319789A538BF61CE3E27249D408003E5BE34316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_man.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_man.dll
Size 1.4MB
SHA256 f815027284742cf09d988df5753f6ef9672a744a76d2e40221922a8e5fed574b
MD5 cb33b2fa51394305d0b89800af146953
SHA1 de171d6489d910c243fc09ed270bc147a436898f
SHA512 14962dfee3e156842755e8f035a6fc71a805b1516098292a5de48490b797003367edc7b8ce768fc09bbc3ffe8f366214eac2c0c55552e5c21b0f8f0793667b5a
SSDEEP 24576:QYeveW4JNkDbepFOFsF+Bv+fTcJclJ6tzme3Z7abGtphB/OBH4OMlDw:s7epFXUBv+fTcJclJ6tl7abGtpDOBH0S
TLSH
T10A651C25232B2F23D65A3379F7E31EA1A3346C4537556393B19BE02509E628CB2F7D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_printer_integration.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_printer_integration.dll
Size 6.1MB
SHA256 569f35001a5ca05c3a1e3612be03b0092497c8d80ddb7e0fbbbc697d2938ae3e
MD5 4d9ba1a2f09eaf6f11625d996f5b85df
SHA1 4c27ccaf47e567beb6d141ae3edda636ad9d143e
SHA512 6817953898c405a8eea48cb34dcaa3aae3d8c43dd76e926448ad16d45edc1e3f5aec417762ea57520dbb84ea6b140deefa742c3f03b5ecb6cf41c3827edc2958
SSDEEP 98304:YFSEe2IuZRia146aHH+DtGZwn/BC4CGTD8Nd:YFSq7CA4Z+DtGgC4CiD8Nd
TLSH
T1EA567C03E19640ADE055C134CA26A632E7717C090BF569FB2690BAE92F73BE07B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_printer_integration_x86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_printer_integration_x86.dll
Size 5.6MB
SHA256 9fb7e85763a0536dffaf8e845dbdcfda957a6f7fc4eb62f3449646c80cc424e7
MD5 17a5854f613ecd30f441efa3b208a2ce
SHA1 ee734de0a6d7423784f768cead1ad88b54f46ae7
SHA512 dbfaec9c8c53aaeef59c2a832b0a065656762179705b0c7176d290080b279ac293a1defad4b705eebd45da9520d3212a1083cb8b83418a5cd1634ec1feeaef96
SSDEEP 98304:5fMDxGMbx8gV/TBzrT3Ei/DJwPskivWW2a8xYla6+oZLVrScSsgjsnBTOD3Zsfzm:AxtdTEi/OPfUxrSETEsr/zkKtGgCICpv
TLSH
T1AF46BF02F0129035C6865170FD2AF73A6B606A3A1BF708FBB6D4ACE42F745D1327965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlp_text_extractor.exe

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlp_text_extractor.exe
Size 5.1MB
SHA256 bffd443d8077de097d605bb22d67fe170b2bef8bd792aede2b20cd3e5cc7cf4e
MD5 f9aa03a5c2e8f10a8e05daa7f1a7f7d2
SHA1 1c2829bec5dc63c9e50e1c2e0af26bc697fb0da0
SHA512 8f9c25b7079ccde30865ceef8307567a467505a24233071769b009e0570571565736bf090bcc7906a6eadfa94482f0ae870a1e17244c5bd75cf4355c58af746a
SSDEEP 49152:+GtlqGGVwASOj1RtnYi1daCTT+eAGK85dyH488caUyQFJLYIi53HFJI2eNsY4o7p:y7g4bXQ8Ii1Fk5Fjie5+9g
TLSH
T11B469D69B5BC00D6D4BA81B9C2865227E771B85547F057CF2A6086FA1F23AD02FBF740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.inf

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.inf
Size 5KB
SHA256 87f883078a3c7d38126e409411028dc50786ba964014434d118e486c550dd5de
MD5 0299e7522ef62920eb0cc3031643967b
SHA1 f6911845b166216f049f1a29bf02128627c28843
SHA512 21dea56065ea2fbc61850be511877766429ceff1c712808c221179155d9a39bdfc12f6be485c2b4bf5669bf7ee0873dab3e37d27ddeadb45ea9bead7e4bb8eaf
SSDEEP 96:vNQBG1m2UZWJ8KchywKUi+bJie7HJSe7mkakn0NkknrrPpu9nmMToR:v9mXtEFecettn0KknrrPEEpR
TLSH
T128C1EE547B82C678A8463710FF17388BA7A539A0C4F4343176EDD841A3EAA8DC674BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpdrv.sys

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpdrv.sys
Size 253KB
SHA256 066474134b7245abe3a17dab063031db32ab4289b36d3b7942ce8b6551bcdf7a
MD5 ff3a5c133355658eea9dd186962248ea
SHA1 2ec84bf2e5da2eedb40f181cf24e8eb20c1137be
SHA512 1602c1161c0c8ad49af2ff5c95612549a7ed984b1f430359de4b7f0a3d9ff0426cbcd1d753d57f4fabb3e3ce9afb6e0f3a79b6e7b90f1236bff8765260727879
SSDEEP 6144:94MPwWFsqqdI5F64h8ZnI0yFpEpiAeJatPNpigw9:5Ysshg6lZpeWe
TLSH
T14C447C16A39509F4E9A68235DAB3C223DAF2B4452731C6DF02A481981F27FD0F97DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx64.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx64.dll
Size 120KB
SHA256 8d424a40a3e4725435b235c28858cd593757db6168a12a7faddaa0713f9d28a0
MD5 dbcc435243e80b713efbab1e48cd851d
SHA1 5b606f8dbfe22190d01387d078cb98e0a83d2883
SHA512 69ae3d7a753ab0a9feff6cec27e6acf0a1eb427ab3fc6af1833e6567529f88bede4772ba19ba1ae834b95799407eb9003c0f39f79a4f572e40a14bbcecfe8b49
SSDEEP 1536:qJxMHGqIPaOxdNUWjOpbwS5jq5M17wY3czxqH:qbM9IHU7p5Cew9s
TLSH
T10FC3D73A73A400AEC91B8530D527B96BD7B1F08607A2E3DF0F555AEC4F87B845D3AA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpx86.dll

Path C:\Program Files (x86)\Netskope\EPDLP Deployment\x64\epdlpx86.dll
Size 102KB
SHA256 352e878f144124e868cd87bf05aac18ebcafa7c8b083a9d7404754e26f243f86
MD5 cfc4edb05d452e9e2451d4dd495b4f71
SHA1 7ca5d98caf6b418867db46c1d7224a55429e05cc
SHA512 2e3ab6f3f2ae8058d24bd70b50b0c42737a8c270b42273075907bb5442b50f0a63300e5fb17c53b0ebaf3b6075f1e441fa564a3fb2a7fed3a96e0a3cd1ee6ce3
SSDEEP 768:GhdbdHphLVc4/25EbeLKStLjBqfWQsQGmhrBN5M1mUV/uFkdr2R1OTV+w8kq3o9S:GhdpHtleOSWfvb10mUVak5M1LwGQze
TLSH
T1EBA319A3344C43B6D59A6DB1B09F2B32151FA22097BB8CD766C446C8192C3FE7D7970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\Netskope\stagent\logs\epdlpinstall.log
Size 5KB
SHA256 c9ae61372fa2c172f6427caaedcb94223f798b8f8f1b3f387833b767a2a51c28
MD5 0331f1aa1e9362b022e7cd49f271e6ca
SHA1 967d6c356c5014d6460b0f219671ef2d67014c2f
SHA512 5cee6e7eb50f4f11b790a3b51d15f57be820425fa1da1fa877f8984e5ac5bb8bee7fa23fc361120ea5a87ffcbbc82cfcc932561f4c13b553e8db63997ddaaed3
SSDEEP 96:1SSh7BeRBIl2KZgXRvlpoBqThGzCbEHh5ut+R7QKYm54R4kMlfJUr9LybdRRPRRM:1Xh7BeR2lRgBvlpoBAczCbWh5ut+VQKm
TLSH
T100C19BE7BBE913BC2C046348A8173E7258BD5FB5B5B7244C23D11C014EC6927C6AF466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epdlpinstall.log

Path C:\ProgramData\netskope\stagent\logs\epdlpinstall.log
Size 8KB
SHA256 ea5030ed584a19d3f359c2ccf03af6b4ff4897c67c50470fb50a535b40577dd1
MD5 4da29a6990336cbfc134db17c75276a4
SHA1 ae90bd87e7c363ec0c60370c8053f7aa9e755158
SHA512 87080cc2b37940e01410e7ec6b2d6c7cce68b3a1bbf9e154ec5162873df969a175a55fc783390bb98eece90f855de027d6182352f960ac898d36ea9a9c4ea4f8
SSDEEP 192:1Xh7BeR2lRgBvlpoBAczCbWh5ut+VQKYm6R4kMlfJUrJoV/lJlKlblqlDlgloPTz:TjfARgJGyj/
TLSH
T178029CE6BBEE13BC6C00238CD4263F76A8E86A7576E3245C67D11D010BC6937C6EB461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 1KB
SHA256 f4436218e75f96df01f529666a134ee0f8a7bb9a122ee14b0cac056f3f65cceb
MD5 2fdd46b3e2f58c9da827b08c5b42da9d
SHA1 b5ca8df740cdde9f506d8df4216d3cfac7c0c732
SHA512 c019f1e93711e98f190fc87106bb306d160468d23303464f0b507ed027000985bb887b2da80c7df5c200675bbb11a34598c64f01e83d7ef36f1ebc5f47c68c25
TLSH
T1D231F8A50ADE3A817FDF8F641DC08A620E74609439BDA2935C77976538403E32F64826
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 3dfda744dcf721a7f73ab2d94a4f865c734cd608e3b51631903db793678a1694
MD5 5eec72deb6c154f6a9bc60edf6e4e204
SHA1 8d8948a7d8511c10d2ce01da3efb04f046aa549e
SHA512 3a7104a79ee9e75e89ebda78e49e64933f56c8618093d74754d938a61157c458f5fab75884a482bccce51ed3100b62560d3d7694172802f283931578cfcf53e2
TLSH
T10131FA66DE7834829F50ED945DEAF233AC9077C0BCD530816626444B24803F36F49D8E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 6586c7f77b90bdc4ead98b86215d1b3e3cfde231c19ba93c8e49fc28fd7d6461
MD5 26c44a74ac4d1decaea4d717030497e8
SHA1 0d139b65d3cfc3b12ff33f79d166834eaafc1573
SHA512 7bbdba2e24bd5d00d4aca093f49ae90e62df86b6a80d54440c04d2e080b9ebd15148c5d0bbf5afea759c19d6af4485fe8511b156ecedd91afbaa760930280554
TLSH
T10A21E69746A72013EB06CE8C05D8AF732CF1F7D065DD0412B0AFC2A558213E37EC826A
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_EDBB6C798C90E9F99180FA6B4906DA83
Size 540B
SHA256 c04ae0c04c7bd3d557422b3f7a9e978d6f84ac76bb8135338c6072cca87845e7
MD5 07d88c645b948c8cf48f96a4ae350929
SHA1 6ad233ed98636e20f365e7b80d1ca09d4542a527
SHA512 0fdec716739970537b1d0a3a393ac563abd3dc840e5f599d75c8e16e6b31a8ced5d680b96e2d29925a3903142260df06d0a73333c0c5eae7acb02820bc74cdf8
TLSH
T1D7F0973820FD910FF037DE380BC1B2435D66FA1220121A090E69830CBE29F942C92FBA
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 4a6be36a27dfc6568a2f2614400a5ef0e3a5be4b678edc1ed8a38a1d7d2f0c35
MD5 d27319ab36ff23ae956fbe84a18e1856
SHA1 b8296f378d4ea9ee020dcfdca7330ddeea688b10
SHA512 7c7939318bc5abbac01cbf764dc3acd30b0e1e41b8387574ecdc9c03e840d58b5df52cdd40fa26d48dceb67997007e5f702cc510f12394f01c53ad5d341490af
TLSH
T121F0DC0802F5821EF07BC9B45ED9E067D5A5FC025C065AAD131A0B2E5D31F808D2743D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 c27e6f4a63ef4e742fea0b60bc35191f34d4cfcf2a9cb4dcbd6f838cb1c9617a
MD5 bab4425be2eeaa85149dcec94f7c3eb6
SHA1 ac34c31fc5fce6aa83253fc753e01c054ca43c9a
SHA512 5aa471c32d0d481044f10d45170181d40113e206cf7a18237d759a2fede0d4fcdd379f7370c5edf021246df59d0711e67a7de13d7d829cedf353af7f2142db87
TLSH
T1CFF05C2428B9B10CF231DF7811D122F56E1FBD0324511EBD2A55665CAB24F415C55578
MD5 SHA1 SHA512 TLSH

Submit Download

MSI765F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI765F.tmp
Size 6.5MB
SHA256 f90fce0742bf63bea68a251271241edce67db1ffd3df0322ec659a0c7b15b1d3
MD5 0759c8c1b4ba270860a194a34299cf9e
SHA1 0b5d75821e347a8dfec6759088249cc4da600447
SHA512 ce30fed32bf2854defe81737e12806350c58751f6a5d946082c8198f48b30878a08ac22124c5547ed9a6580ee37866c16da7b8d0ce6c24b1dd31a795960917ce
SSDEEP 98304:KzaVYotSzT2iWIWXfcvekhRYoaDWmPwLRAB2fPTUyGEt2QEB+U4jWu:KAXtSzT28iEWkhqokKXQyGEt2QQmWu
TLSH
T1AA66AE12FA01C071D8DD01F521BEABBA897C5D30973445C7E7C02EB99A615D27E3AF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dad94e4-5e52-4879-b826-1289856bb90b.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\1dad94e4-5e52-4879-b826-1289856bb90b.tmp
Size 3KB
SHA256 48cb0c55a7df7f14e4d7d4fb15554ed7e4f12649155ee177c1992848b1cfc86f
MD5 306c0443af2d36fb8f20c3b3ff47119e
SHA1 da57cb1fdbf4bd9e9b131d3c40512d5812c54c62
SHA512 94f5ce79ba877a368f9856e2f4eddf9b15ffff0d3b394aba9c563ea74adf75de1869a333499eb79749fe90530fc4b38c0ffd0f1a1df45086de34ae5004017c4b
TLSH
T10661A772A870AA778EF39B05B9863716A7A55177E5913F95C5EC0F0C02D73882342C27
MD5 SHA1 SHA512 TLSH

Submit Download

800e147a-c9dc-4236-81bd-ac034b568dcb.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\800e147a-c9dc-4236-81bd-ac034b568dcb.tmp
Size 2KB
SHA256 e359ae8d66a8c2bbd10f6860b8af93a755c9bdc04a65448dc1bf9815ff76fbd2
MD5 79acf29d371f4041215df1a8d1e2fdae
SHA1 2193ad5738a45033ee8afc0a449fae34faeb0fca
SHA512 3a49e554c6f7b442d4e2f6571b66fd86541bab6216263b07ed2e3560bad93ff04badc0d5352766fd8c3a85d925b22facf55134e5494316cc826108f152d3718e
TLSH
T1F4517473A824AB77CEE35B447A473A239A7991E6EA511F9499DC0B1C02D725C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

8969defe-d16c-463a-ae24-c0b3adeab2ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\8969defe-d16c-463a-ae24-c0b3adeab2ce.tmp
Size 15KB
SHA256 0cca4723637a5b1793e8c73f70ac8399687dfdef8a3d79ff06c56f588149f819
MD5 c30b1e7e800233bd1073750881df71c9
SHA1 e475383f1bacbcd08ff104df36ab0dd49ea2049e
SHA512 952d9606dd05302d6bfd3317f7d0bcb8e7698f233eb1fdc3ce5e801e36b0ff6debe99c743245f97a8a0e7a740cd1c30ba4c848343f406e1db938a952cdec6cf7
SSDEEP 384:Q+OBqImmJvGBLx3NaFMJFNNBSxgyMx3zick3Q3kg6rv:JcvGtlNN1BkOab
TLSH
T1F372AE7A18761B632CF7C649BA8A33478F71A253C1D57BD9CCEC9F0E226B2941352D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ed86bed3ddcfe1730f89bd170fccff0e2d9a039b018bc79991afaffaae4e4fd
MD5 bcb2188da7df1dcc3d68e49242a1e2ce
SHA1 b88ea5fa0b76dd7babdfba9ff81c587dd244b744
SHA512 0051972d3a7af346fe66f29934910634498f228f2ef5da17aac9d3969b1bba994709a3b9cfb1a4275264693d57ac710240472f833bdfd0c5e2e7e059f5429d67
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a8edf0d660ce83e5f58324919c30152042a256bcaecb0d9a758af48097553f43
MD5 96efe3d0181627ff62d4b58da652c60e
SHA1 f7cffe9e80ed6bc082fb983214ee689a1f962ccd
SHA512 6fdddfb5d09dd7558d7d3298f9da6a37176aa5c41828efcd6a8a1d2c7787eef29229998a31e4abcb10719c5afbf2edaeea0261b02e82f4d58af98471de336bcc
TLSH
T1ABD012133243823AC0103433081361081401C91F40458050D83D859E6A44454090F451
MD5 SHA1 SHA512 TLSH

Submit Download

19494e5e-687b-47fd-98b8-6ab321357bf8.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\19494e5e-687b-47fd-98b8-6ab321357bf8.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5138d81d-7d24-4a4f-b899-be68bdec22e3.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\5138d81d-7d24-4a4f-b899-be68bdec22e3.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\Network Persistent State
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e4a115cd-2ff6-441f-a370-f80a887b442c.tmp

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Default\e4a115cd-2ff6-441f-a370-f80a887b442c.tmp
Size 6KB
SHA256 5b9856c151e307e85ec5fb36b0651ded21b973dea5eef1729f70783090fdc744
MD5 9beda953a200325657285592063354ba
SHA1 07a5c5274d1af00bdc0bc8bef78a4cfcb7fd2b92
SHA512 6dc982b5bdec114072c0b2b1d1475146286d5f4062ba5089d22d99093462267ee422469ea065c6283325f7aee988257a0453e2c99a21f309b75b0ba154757d94
SSDEEP 96:stq/dy9SIb9Qkno52G16ZZs7/x+6MhmuecmjeLUK+g728XM1C7jL:stSAuSoqsV+FijsdG6v
TLSH
T1ACD197015E28797B8CC6F109BA297B52E2F5A13274D51D58EBFC461C05D76DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\netskope\EBWebView\Local State
Size 1KB
SHA256 de34ff1f60255079a3aefd65dc643ef40494615c072116843fd27b5155623173
MD5 c28f27290d498025110c9e33eb1ef984
SHA1 b24430af47d8f2584860262f619ccef49412242f
SHA512 c35031d38e24ba941523cf777afcd4d35ff6f328d1b16fa49bcd6548ae93a58e7100c8d63d1c3fe4cc07945d7367c72e75406721f63ea7b1b4ed78c415ec3432
TLSH
T1FC2140B2E8B45B73AD966686325276676E6151FAD2508E4450DC8B2C02E324C623AC33
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 968B
SHA256 6f56757738884bef4dd0e86e2a07632a53cbc420d6e807dcb18bc345ca469796
MD5 fc0f440048a089d2b4811f1bb5e7b59d
SHA1 abaa784f334388c10f0090e7761733eab5b0ffd8
SHA512 7d39c5a3039f492237bbd2b1526f9060ccc9879c4bb678d45e074bbe22211ca9bae5edc49b7bfd86eed11b6c78191ede7542fd251ad90d0e9d86f2cd44c3c9f2
TLSH
T18F119E010B4589FB080C5CD1EE45D41D4FA1666C324F6A38F7BD536A2F4C254793F9B4
MD5 SHA1 SHA512 TLSH

Submit Download

nsAppUI.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsAppUI.log
Size 8KB
SHA256 6497653ad4dcb0cc80793aab634916675230544ed80a5fdea978e7d40d8bf977
MD5 4f36f07da36b0b959c3322ccbe70130c
SHA1 b00c81102d2f7543ff2af133edd8f9c8a149d889
SHA512 95a87e9d6b1d721eee244adc47cb3df7ac1d03ae67b34e35dd8cebc4f678094811ffd10d7b716101c1e509c2b121ead157004db35194be7ffa768c3aa16c7789
SSDEEP 96:bzKyGNKF5bcPHUTZG3OrZ8Zs8fBwd/56kGPyv26WnBWslKWsl4J:qfOYaGerZ8Zs8fBwd/InPylWnBxKx4J
TLSH
T1B012F2091F5985BB181D0CD4EC88C42F4F739A2A321FB639B7B4A3946F0C590667F6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 1KB
SHA256 4eb3232eaec2b7cacbd86491526a60faf2f0a5c7ab22b50d2499e80dd2a81493
MD5 4cfac96a1b872f32b07292f7afc6d8d1
SHA1 8b6171e91268641328cdcd850647ad1f5bed2b96
SHA512 37a0fadd2eb7f972a76e02de7e4dc1b65f9725bf8d5cf4696f3b9094fbc3e6c9342e23d7c1c0fbdbe3611295f06688ce93d535d3dd94085e0f69dd086070ba79
TLSH
T107310C348763507D7E073FDBC393EC144A71A861938A537AB3CF9322674C590612B857
MD5 SHA1 SHA512 TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 4KB
SHA256 0c756a09e642096cd941b4841050ca1769a203aaa660e0773b1234d26900530f
MD5 5a1544ae46173851558ba3e42e5e8d4b
SHA1 ea235232485d5e15be75d573767ed5d7030ea807
SHA512 8e35053c939d1f3b38ffc1c87cc1cab5a5eb405d625a9dc4833ac08455712a9dc968f5f5d5452c6b91a35f7e6c1c34e38be8579772f10de6f49b59b043114667
SSDEEP 96:Rw1w0rspA9/Migg0pk0ofBhST++y+nC2W7W69wz:Rw1w0YpA9EI3dQ
TLSH
T12F9159358767E53F3A173E8BCA87DC284F319954A34A037A73AFA716670C450726E863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstallation.log

Path C:\Users\Admin\AppData\Roaming\Netskope\stagent\Logs\nsInstallation.log
Size 6KB
SHA256 9cda606e5fd80d5dbba9a65026b8d8239cac14d8c3351e418903ac2539b1b761
MD5 b89ce6bcc45a77e3f8ed1a8d1eda57fa
SHA1 df648a106a462aa2bf27e38a9c21df57799dd895
SHA512 51c893136673fffd8157ea5b0752b219e9eab7f6ccd72bfdeaa6a4e131b5d139d1bbd5356f596c5bc4f4c17f4dd5efc5bf8cf71c893d1ab401750e81a7328eb3
SSDEEP 96:Rw1w0rspA9/Migg0pk0ofBhST++y+nC2W7W69wiyGGKJ5wjzKQj:Rw1w0YpA9EI3dv4Kg1
TLSH
T198E1BE368777E47F365B3D8BCA87DC3C0F319554A34A037673ABA726670C450226E862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1AD.tmp

Path C:\Windows\Installer\MSI1AD.tmp
Size 774KB
SHA256 1feb73f5b4960646666ce43112df927d4b1967dc4b87c928c2ad8353a30da7c1
MD5 172ac05c2285a63f5bc9b7250c35b490
SHA1 c3e4249e590c066f286aacd21e02139fc6830a2d
SHA512 cbc9d540edc2e387bdc49792dcdc270cef9f5231cbb5674cf1329fbef4a4fb5702180cdf02c0360a1eba250c37ddb943ec2dce079e158299bdad6980082b926b
SSDEEP 12288:Svx3IfGMvHq62NA586qxJWHTF2Ni5ph0lhSMXleH06Rm5:Svx3IeMvBF0fWH+irh0lhSMXlQRm5
TLSH
T1F6F49E1AE7A801B5D1B7C179CD934902FAB27C494361ABDF03E58A952F23BD0563FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_137191146\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4756_1390259500\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 44d1753cf52a8186ac3cb55d31f8a6bc0f418422ccd05be849540e5d695d2015
MD5 ede635b46a411940bedcc149bce81fa2
SHA1 85e49de4efa4a8c66f63314daa44ccb3ef2d6e49
SHA512 c2515ca6cc9645343d1e6457ea5e4e1885f56c5e5044ff1a4b8ee2b1869a94370af1f198c58705c12ec6c82d5e6a5904bccd0efa12c8fe17f578e732655c0224
SSDEEP 24576:bFo3DMP/doO/vvTL/SQPvCFg/L+F07osEiJdNiBH5KBq5YOfc4h2PW1+ruv:VHI
TLSH
T1D857A12436F92200E7B79E3DA8F06A634D3A7D5B9C15DE8D45411B8E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{317d885f-9a21-434d-9c74-e29c82418b2b}_OnDiskSnapshotProp

Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{317d885f-9a21-434d-9c74-e29c82418b2b}_OnDiskSnapshotProp
Size 6KB
SHA256 d1d3e95e53d534d81e307bdd6744bc42f99b5edfb66aab6f3243aa8d773d2699
MD5 b4609de879ca220a0061766c58621975
SHA1 f4609743b2b4a956852524cef4e5b2a46494bb7b
SHA512 d89cdba8243113c34828d0af2462ad7eb5c7e35aa98a442ccf57ba3253992cd785caa994770a9576922d7f44e5c1533c3a9fb9154961685f78819e3fdab98ba9
SSDEEP 96:FZQnrF1d2aqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:4nrAb++uVm
TLSH
T183D1780C5AF54711E2B3AB3128F58557A877B811EF33CB8E0198238E2661A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-1051-0x00007FFB7F650000-0x00007FFB7F651000-memory.dmp

Download

memory/564-1050-0x00007FFB7E570000-0x00007FFB7E571000-memory.dmp

Download

memory/2656-1009-0x00000000001F0000-0x0000000000B52000-memory.dmp

Download

memory/2656-1010-0x00000000721B0000-0x00000000725FB000-memory.dmp

Download

memory/5056-589-0x00007FFB7ED40000-0x00007FFB7ED41000-memory.dmp

Download

memory/5560-604-0x00007FFB7ED40000-0x00007FFB7ED41000-memory.dmp

Download