Overview

overview

8

Static

static

8

GoogleMeet...rk.exe

windows10-2004-x64

7

GoogleMeet...rk.exe

windows11-21h2-x64

7

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/04/2026, 00:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GoogleMeet_At_work.exe
  • Size 10.5MB
  • Sample260417-asvzpsc15k
  • SHA256 f8c67e3643b2e1f4782f5b0fa4326fe018d0d186ec2243f897c534465a0995fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GoogleMeet_At_work.exe
    "C:\Users\Admin\AppData\Local\Temp\GoogleMeet_At_work.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3704
  • C:\Program Files (x86)\CentraStage\CagService.exe
    "C:\Program Files (x86)\CentraStage\CagService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:240
      • C:\Windows\SysWOW64\regsvr32.exe
        /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1736
  • C:\Program Files (x86)\CentraStage\Gui.exe
    "C:\Program Files (x86)\CentraStage\Gui.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5508

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AxInterop.MSTSCLib.dll
        • Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
        • Size 240KB
        • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AxInterop.ViewerX.dll
        • Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
        • Size 40KB
        • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CSIcon.ico
        • Path C:\Program Files (x86)\CentraStage\CSIcon.ico
        • Size 27KB
        • SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CagService.exe
        • Path C:\Program Files (x86)\CentraStage\CagService.exe
        • Size 19KB
        • SHA256 eb209f6eccdebca405183de5f24ef34ee8c850615e6ab9f086f5a4fb6851e071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CagService.exe.config
        • Path C:\Program Files (x86)\CentraStage\CagService.exe.config
        • Size 3KB
        • SHA256 a8d2de27da209a0a5ee0eb43534aca10f51da4446bcc2395e98e8e6af902dd37
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Common.dll
        • Path C:\Program Files (x86)\CentraStage\Common.dll
        • Size 16KB
        • SHA256 74e9ea4521981be2e6f2ed16ac290a7c02edda5a5c9667e73c81f6e26279e19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Core.XmlSerializers.dll
        • Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
        • Size 10.6MB
        • SHA256 eb627549fa4ba8dfedbe22ab7dda5ef750ee29a588ae8760b73ff39f6af3cc1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Core.dll
        • Path C:\Program Files (x86)\CentraStage\Core.dll
        • Size 2.3MB
        • SHA256 4d47bbb4ff0b6739fb6e069087b6d73b0e2ebc173da9fa47a3a94fcbc506d9f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FSharp.Core.dll
        • Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
        • Size 1.3MB
        • SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FsLexYacc.Runtime.dll
        • Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
        • Size 69KB
        • SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Gui.exe
        • Path C:\Program Files (x86)\CentraStage\Gui.exe
        • Size 2.0MB
        • SHA256 5cb69d880a0ceb97926036debb3e01ea2095e8766f49cedf27658a18002cf217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Gui.exe.config
        • Path C:\Program Files (x86)\CentraStage\Gui.exe.config
        • Size 5KB
        • SHA256 71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ICSharpCode.SharpZipLib.dll
        • Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
        • Size 196KB
        • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Interop.MSTSCLib.dll
        • Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
        • Size 468KB
        • SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Interop.ViewerX.dll
        • Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
        • Size 76KB
        • SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.Extensions.Desktop.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
        • Size 46KB
        • SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.Extensions.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
        • Size 30KB
        • SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
        • Size 36KB
        • SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Web.Services3.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
        • Size 864KB
        • SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NLog.config
        • Path C:\Program Files (x86)\CentraStage\NLog.config
        • Size 2KB
        • SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NLog.dll
        • Path C:\Program Files (x86)\CentraStage\NLog.dll
        • Size 678KB
        • SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
        • Size 528KB
        • SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Snmp.dll
        • Path C:\Program Files (x86)\CentraStage\Snmp.dll
        • Size 178KB
        • SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SnmpSharpNet.dll
        • Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
        • Size 108KB
        • SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.dll
        • Path C:\Program Files (x86)\CentraStage\System.IO.dll
        • Size 20KB
        • SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
        • Size 21KB
        • SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Tasks.dll
        • Path C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll
        • Size 34KB
        • SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Transitions.dll
        • Path C:\Program Files (x86)\CentraStage\Transitions.dll
        • Size 17KB
        • SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Vim25Service.XmlSerializers.dll
        • Path C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll
        • Size 8.5MB
        • SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Vim25Service.dll
        • Path C:\Program Files (x86)\CentraStage\Vim25Service.dll
        • Size 2.7MB
        • SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WeifenLuo.WinFormsUI.Docking.dll
        • Path C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll
        • Size 402KB
        • SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Program Files (x86)\CentraStage\log.txt
        • Size 5KB
        • SHA256 26d53991fed566f7e734d3568e88b491c073cd59563154e570ec9072180dbee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scvncctrl.dll
        • Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
        • Size 1.8MB
        • SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Settings.json
        • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
        • Size 352B
        • SHA256 036855a2750ccfd177c38228d012ec7a367247b36e7e9bb5b6ee03510ec63862
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        offline.ico
        • Path C:\ProgramData\CentraStage\Brand\offline.ico
        • Size 20KB
        • SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_agentrto.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
        • Size 26KB
        • SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_alertmodeoffline.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
        • Size 23KB
        • SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_alertmodeonline.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
        • Size 27KB
        • SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_ondemandmode.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_ondemandmode.ico
        • Size 25KB
        • SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_privacymode.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
        • Size 26KB
        • SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_stopped.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
        • Size 21KB
        • SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 4KB
        • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        C56C4404C4DEF0DC88E5FCD9F09CB2F1
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
        • Size 1KB
        • SHA256 46011ede1c147eb2bc731a539b7c047b7ee93e48b9d3c3ba710ce132bbdfac6b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        F2E248BEDDBB2D85122423C41028BFD4
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
        • Size 1KB
        • SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 342B
        • SHA256 bd688e5489db2c85150da5ac039ab0b7c868ee71c5a50034e91ce9b9d49f5931
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        77EC63BDA74BD0D0E0426DC8F8008506
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
        • Size 330B
        • SHA256 cf3f1ab34bc115c3b507a55bc93de75bafdbd50082564c80610d4bbb36a11216
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C56C4404C4DEF0DC88E5FCD9F09CB2F1
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
        • Size 308B
        • SHA256 45f74cdbb51516b43cec7c239eba061742bfc5c6505647de016d04ae610bee79
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        F2E248BEDDBB2D85122423C41028BFD4
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
        • Size 254B
        • SHA256 9f2c1cccf7cc9d8d86444e6de2857dbd2bd390f5ad34c810aff764586eb4e2ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        omoam3ac.newcfg
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.10748.10748\omoam3ac.newcfg
        • Size 1KB
        • SHA256 cc5b08d1508ee11d8fb7e9a8501fa03779fbb15ae9961dc3ecd17fada0e4f6a3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        u51jqzj2.newcfg
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.10748.10748\u51jqzj2.newcfg
        • Size 495B
        • SHA256 435ff58e0f0f70cf0ef41ba5fd40a4e553b5dc12b41777fb1d99f60ebbf8cab5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.10748.10748\user.config
        • Size 344B
        • SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SimpleFC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\SimpleFC.dll
        • Size 175KB
        • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SimpleSC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\SimpleSC.dll
        • Size 61KB
        • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsSCM.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\nsSCM.dll
        • Size 5KB
        • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsisXML.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr4802.tmp\nsisXML.dll
        • Size 11KB
        • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1lel3pfk.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10748.10748\1lel3pfk.newcfg
        • Size 313B
        • SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        chzrzqih.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10748.10748\chzrzqih.newcfg
        • Size 438B
        • SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ilrxfcks.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10748.10748\ilrxfcks.newcfg
        • Size 725B
        • SHA256 a11e260dd7e919fb5e5d34cd2492df573ec5e5af338604af3b8a39b5227be375
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.10748.10748\user.config
        • Size 313B
        • SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1736-365-0x00000000014B0000-0x000000000165C000-memory.dmp
        Download

        memory/3704-282-0x0000000007260000-0x0000000007806000-memory.dmp
        Download

        memory/3704-368-0x000000000A220000-0x000000000A270000-memory.dmp
        Download

        memory/3704-577-0x0000000007180000-0x000000000725A000-memory.dmp
        Download

        memory/3704-506-0x000000000A4B0000-0x000000000A57E000-memory.dmp
        Download

        memory/3704-505-0x000000000AE10000-0x000000000B8AE000-memory.dmp
        Download

        memory/3704-301-0x0000000006380000-0x00000000063F4000-memory.dmp
        Download

        memory/3704-299-0x0000000006CB0000-0x0000000006F0A000-memory.dmp
        Download

        memory/3704-298-0x0000000006260000-0x00000000062F2000-memory.dmp
        Download

        memory/3704-333-0x0000000006660000-0x000000000666A000-memory.dmp
        Download

        memory/3704-469-0x000000000A370000-0x000000000A37A000-memory.dmp
        Download

        memory/3704-302-0x0000000006400000-0x0000000006456000-memory.dmp
        Download

        memory/4400-0-0x0000000000438000-0x0000000000439000-memory.dmp
        Download

        memory/4400-117-0x0000000002FE0000-0x0000000002FF3000-memory.dmp
        Download

        memory/4400-166-0x0000000000400000-0x000000000044E000-memory.dmp
        Download

        memory/4400-79-0x0000000002FD0000-0x0000000003000000-memory.dmp
        Download

        memory/4400-55-0x0000000000CF0000-0x0000000000E9C000-memory.dmp
        Download

        memory/4400-54-0x0000000000400000-0x000000000044E000-memory.dmp
        Download

        memory/4400-167-0x0000000000CF0000-0x0000000000E9C000-memory.dmp
        Download

        memory/4616-261-0x000000001B270000-0x000000001B288000-memory.dmp
        Download

        memory/4616-254-0x0000000001A30000-0x0000000001A42000-memory.dmp
        Download

        memory/4616-188-0x000000001A6A0000-0x000000001A6D2000-memory.dmp
        Download

        memory/4616-137-0x0000000000C00000-0x0000000000C0A000-memory.dmp
        Download

        memory/4616-225-0x000000001B4A0000-0x000000001B752000-memory.dmp
        Download

        memory/4616-218-0x000000001B160000-0x000000001B1D4000-memory.dmp
        Download

        memory/4616-141-0x000000001A7B0000-0x000000001AA0A000-memory.dmp
        Download

        memory/4616-259-0x000000001C5B0000-0x000000001C708000-memory.dmp
        Download

        memory/4616-139-0x000000001A4A0000-0x000000001A550000-memory.dmp
        Download

        memory/4616-142-0x000000001A710000-0x000000001A720000-memory.dmp
        Download

        memory/4616-232-0x000000001B2C0000-0x000000001B39C000-memory.dmp
        Download

        memory/4616-260-0x000000001A720000-0x000000001A742000-memory.dmp
        Download

        memory/4616-242-0x000000001B1E0000-0x000000001B230000-memory.dmp
        Download

        memory/4616-575-0x0000000001A90000-0x0000000001AA2000-memory.dmp
        Download

        memory/4616-576-0x000000001A710000-0x000000001A720000-memory.dmp
        Download

        memory/4616-252-0x000000001A670000-0x000000001A69A000-memory.dmp
        Download

        memory/4616-574-0x0000000001990000-0x000000000199C000-memory.dmp
        Download

        memory/4616-284-0x000000001B3E0000-0x000000001B414000-memory.dmp
        Download

        memory/4616-171-0x000000001A650000-0x000000001A65A000-memory.dmp
        Download

        memory/4616-251-0x000000001B230000-0x000000001B26A000-memory.dmp
        Download

        memory/4616-175-0x000000001BA00000-0x000000001C49E000-memory.dmp
        Download

        memory/4616-249-0x000000001C4A0000-0x000000001C5AA000-memory.dmp
        Download

        memory/4616-502-0x000000001D440000-0x000000001D968000-memory.dmp
        Download

        memory/4616-248-0x000000001A760000-0x000000001A79C000-memory.dmp
        Download

        memory/4616-245-0x000000001B760000-0x000000001B812000-memory.dmp
        Download

        memory/4616-513-0x000000001B9B0000-0x000000001B9BC000-memory.dmp
        Download

        memory/4616-515-0x000000001D1A0000-0x000000001D22A000-memory.dmp
        Download

        memory/4616-514-0x000000001B9C0000-0x000000001B9CA000-memory.dmp
        Download

        memory/4616-525-0x000000001D110000-0x000000001D132000-memory.dmp
        Download

        memory/5508-250-0x0000000006750000-0x0000000006AA7000-memory.dmp
        Download

        memory/5508-253-0x00000000070D0000-0x00000000076E8000-memory.dmp
        Download

        memory/5508-151-0x0000000005D80000-0x0000000005D90000-memory.dmp
        Download

        memory/5508-150-0x00000000058F0000-0x00000000059A0000-memory.dmp
        Download

        memory/5508-147-0x0000000000BF0000-0x0000000000E02000-memory.dmp
        Download