Overview

overview

8

Static

static

8

AgentSetup...a2.exe

windows10-2004-x64

8

AgentSetup...a2.exe

windows11-21h2-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 18:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AgentSetup_Document1214a2.exe
  • Size 10.5MB
  • Sample260504-w4psqaex4l
  • SHA256 015f182d2aa1edfa79a7d505cd9fdbdbf6f4ef8ef5b02d377e359e1de9fd2d3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 11 IoCs
    defense_evasion
  • DattoRMM remote administration tool 1 IoCs

    DattoRMM is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 47 IoCs
  • Drops file in Program Files directory 58 IoCs
  • Drops file in Windows directory 13 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\AgentSetup_Document1214a2.exe
    "C:\Users\Admin\AppData\Local\Temp\AgentSetup_Document1214a2.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:728
  • C:\Program Files (x86)\CentraStage\CagService.exe
    "C:\Program Files (x86)\CentraStage\CagService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Windows\SysWOW64\regsvr32.exe
        /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2196
    • C:\ProgramData\CentraStage\Temp\e07d8196-1310-4286-aa4c-b9be1ff55806\AEMAgent.exe
      "C:\ProgramData\CentraStage\Temp\e07d8196-1310-4286-aa4c-b9be1ff55806\AEMAgent.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:636
    • C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
      "C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"
      2⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1636
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="AEMAgent"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3460
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2820
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3060
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Drops file in Windows directory
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:956
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:556
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Aria"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3272
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2796
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 14.9.1.11030"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:5072
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 14.9.1.11030" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2432
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 14.9.1.11030" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2932
      • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe
        "C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" --web-remote-daemon aemwr-3fb57ce6-c407-4444-b9cf-349186bd2805
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4948
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:4384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -executionpolicy bypass & 'C:\ProgramData\CentraStage\Packages\7a32f8eb-ca42-4254-802c-69190ef5f478#\command.ps1'
      2⤵
      • Drops file in System32 directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\lrrtabhz\lrrtabhz.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESA9BE.tmp" "c:\Windows\Temp\lrrtabhz\CSCFD6B5EE85B374A6D917A6A54ECFF71B.TMP"
          4⤵
            PID:3764
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage /v Custom11 /t REG_SZ /d "Windows 11: NOT CAPABLE. Info: Storage: OSDiskSize=216GB. PASS; Memory: System_Memory=4GB. PASS; TPM: TPMVersion=False. FAIL; Processor: {AddressWidth=64; MaxClockSpeed=2500; NumberOfLogicalCores=12; Manufacturer=GenuineIntel; Caption=Intel64 Family 6 Model 151 Stepping 2; }. FAIL; SecureBoot: Not capable. FAIL; " /f
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2996
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4932

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          4
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          1
          T1553.004

          SIP and Trust Provider Hijacking

          1
          T1553.003

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AxInterop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
          • Size 240KB
          • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AxInterop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
          • Size 40KB
          • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe
          • Path C:\Program Files (x86)\CentraStage\CagService.exe
          • Size 19KB
          • SHA256 06d34513b05a11e0c7d353035d441d4a28d1682ecb6d3cc43816bd378ab14fe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe.config
          • Path C:\Program Files (x86)\CentraStage\CagService.exe.config
          • Size 3KB
          • SHA256 d4f623edb068538f8c814dae2b3db6444d440c16b8eb6bf5d54db8a461f76a1f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Common.dll
          • Path C:\Program Files (x86)\CentraStage\Common.dll
          • Size 16KB
          • SHA256 b3dd496b276e315079754781cc8e92b1ff55411717f3fbbb213e21ed1c107040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.XmlSerializers.dll
          • Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
          • Size 10.6MB
          • SHA256 5291a543ffa861bb0a41c1c5702244cb79d9158b24f80174725c45bd77e9ee46
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.dll
          • Path C:\Program Files (x86)\CentraStage\Core.dll
          • Size 2.3MB
          • SHA256 2637e4c7fb3df53c75d2dc1b44f7ffd782197ce3a28826671803d1fe389bcf48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Core.dll
          • Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
          • Size 1.3MB
          • SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FsLexYacc.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
          • Size 69KB
          • SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe
          • Path C:\Program Files (x86)\CentraStage\Gui.exe
          • Size 2.0MB
          • SHA256 4f405ab4adfc0d397f7137ee9bbf7e9a215c311cf120cb78ea261e1abcbdeb21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe.config
          • Path C:\Program Files (x86)\CentraStage\Gui.exe.config
          • Size 5KB
          • SHA256 71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ICSharpCode.SharpZipLib.dll
          • Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
          • Size 196KB
          • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
          • Size 468KB
          • SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
          • Size 76KB
          • SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Size 46KB
          • SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
          • Size 30KB
          • SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
          • Size 36KB
          • SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Web.Services3.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
          • Size 864KB
          • SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NLog.config
          • Path C:\Program Files (x86)\CentraStage\NLog.config
          • Size 2KB
          • SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NLog.dll
          • Path C:\Program Files (x86)\CentraStage\NLog.dll
          • Size 678KB
          • SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
          • Size 528KB
          • SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Snmp.dll
          • Path C:\Program Files (x86)\CentraStage\Snmp.dll
          • Size 178KB
          • SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SnmpSharpNet.dll
          • Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
          • Size 108KB
          • SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.IO.dll
          • Path C:\Program Files (x86)\CentraStage\System.IO.dll
          • Size 20KB
          • SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
          • Size 21KB
          • SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Tasks.dll
          • Path C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll
          • Size 34KB
          • SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Transitions.dll
          • Path C:\Program Files (x86)\CentraStage\Transitions.dll
          • Size 17KB
          • SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Vim25Service.XmlSerializers.dll
          • Path C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll
          • Size 8.5MB
          • SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Vim25Service.dll
          • Path C:\Program Files (x86)\CentraStage\Vim25Service.dll
          • Size 2.7MB
          • SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WeifenLuo.WinFormsUI.Docking.dll
          • Path C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll
          • Size 402KB
          • SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsAgent.dll
          • Path C:\Program Files (x86)\CentraStage\WindowsAgent.dll
          • Size 446KB
          • SHA256 32ec64ce65fb79886222d399973ce609297a9c8ba567cb9a0d0ceaf396e8dabb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 4KB
          • SHA256 4acde3c05c3564be2af565b86a405ab2ef53683ef7bae0a6ca801a9928e7c10c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scvncctrl.dll
          • Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
          • Size 1.8MB
          • SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgentDeploy.netcore-win-x64.14.9.0.10646.2.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgentDeploy.netcore-win-x64.14.9.0.10646.2.zip
          • Size 11.2MB
          • SHA256 c5b1800f909a6bd98a61391575159af7faebdf456f1099f34e9452c54319a77b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RMM.WebRemote.exe
          • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe
          • Size 150KB
          • SHA256 3d12d6d8a118a2ddc43234c28fe36daa477d293bf48494965b1713b20c3f5cdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 79B
          • SHA256 5bda2975f7f63aae332116b91ea1f11bc14aee35f56ca64e1be78271dd2bc9b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 352B
          • SHA256 c477fc6f0a6bd7ab7dc82cd9a7b662b89300c2038fb2bc7f86c8eecff9405788
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 664B
          • SHA256 ba1a3606eab92c5f47ca1db48f21ab7a2143f585d804d4d7536920148533208c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          branding.ico
          • Path C:\ProgramData\CentraStage\AEMAgent\branding.ico
          • Size 27KB
          • SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_agentrto.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
          • Size 26KB
          • SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeoffline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
          • Size 23KB
          • SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeonline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
          • Size 27KB
          • SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_offline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_offline.ico
          • Size 20KB
          • SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_ondemandmode.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_ondemandmode.ico
          • Size 25KB
          • SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_privacymode.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
          • Size 26KB
          • SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_stopped.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
          • Size 21KB
          • SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MonitorAlerts.xml
          • Path C:\ProgramData\CentraStage\Monitoring\MonitorAlerts.xml
          • Size 165B
          • SHA256 820260de7d48b85eb8e3358a8d54f6bbf01ddc2fe68a8bca154045d6a5ed31d5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AEMAgent.exe
          • Path C:\ProgramData\CentraStage\Temp\e07d8196-1310-4286-aa4c-b9be1ff55806\AEMAgent.exe
          • Size 150KB
          • SHA256 275150650e0683d08a2f90fe144aa3c220a38c001f34382167a0566c7d8ee6df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.runtime
          • Path C:\ProgramData\CentraStage\Temp\e07d8196-1310-4286-aa4c-b9be1ff55806\dotnet.runtime
          • Size 291B
          • SHA256 21f6f833533032cb64fbc880c9470f1d895108f2622ec4500c4411f44aee5671
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C56C4404C4DEF0DC88E5FCD9F09CB2F1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
          • Size 1KB
          • SHA256 46011ede1c147eb2bc731a539b7c047b7ee93e48b9d3c3ba710ce132bbdfac6b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F2E248BEDDBB2D85122423C41028BFD4
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
          • Size 1KB
          • SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C56C4404C4DEF0DC88E5FCD9F09CB2F1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
          • Size 308B
          • SHA256 4a9f2f1d747860751125f5805219fd980009fb38e07fdff1e1544a11ad65159f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          F2E248BEDDBB2D85122423C41028BFD4
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
          • Size 254B
          • SHA256 d574acf932e974a0e59d76ec758315dc737d6028b790c36c3c2854c7a7b5c1fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lp1bmtqv.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\lp1bmtqv.newcfg
          • Size 1KB
          • SHA256 cc6f2896d5ef2c86f17fd7206319ed2e24e5615ce62a8221826e59aa9e082db2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\user.config
          • Size 344B
          • SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          y4gwoheq.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\y4gwoheq.newcfg
          • Size 495B
          • SHA256 a2b15fe17e35de8e97395d247e2762ad25bba3692c881df07197f862dbbd6d8f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SimpleFC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\SimpleFC.dll
          • Size 175KB
          • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SimpleSC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\SimpleSC.dll
          • Size 61KB
          • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\System.dll
          • Size 11KB
          • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nsSCM.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\nsSCM.dll
          • Size 5KB
          • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsisXML.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd7EB2.tmp\nsisXML.dll
          • Size 11KB
          • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0c5pjsf4.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\0c5pjsf4.newcfg
          • Size 2KB
          • SHA256 5165de4d0bbf60077b7ff8affdebed9f336deb99465d21ebbc03f00073a65c95
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          3xyscxet.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\3xyscxet.newcfg
          • Size 438B
          • SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          5ekyxcqd.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\5ekyxcqd.newcfg
          • Size 2KB
          • SHA256 2dbb543bfce1bd8eb406d2fddc1eb544d54d7b2d6f75d1e8c04c470e5e00e945
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pn13dcfv.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\pn13dcfv.newcfg
          • Size 313B
          • SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qiqtwzao.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\qiqtwzao.newcfg
          • Size 856B
          • SHA256 accf33ef79320206b6d59e74176beff20706eb8c489cc0c21234b12309576e61
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tluokkrb.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\tluokkrb.newcfg
          • Size 2KB
          • SHA256 092bce77e2d8fe5cb6ef79b855672d088a0a75475a4fa85b7f284439f51829a1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
          • Size 2KB
          • SHA256 0e1f9bcee91908391cb7282e22649933a89cdc8f2a847e04669efbc928d8ac29
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
          • Size 3KB
          • SHA256 c9d0c2a0726f9b3494add27c0e21e59b05539c7420da1ab5eec5b9c5ff4d5ab0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
          • Size 313B
          • SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          z1vcbpc4.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\z1vcbpc4.newcfg
          • Size 2KB
          • SHA256 e6f3c766b21e44700beedf6fed65da78bbf8a33c38c9563f819149ffe819a8f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_ulhxyn2k.fwg.ps1
          • Path C:\Windows\Temp\__PSScriptPolicyTest_ulhxyn2k.fwg.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/556-1264-0x00000184CBA80000-0x00000184CBA88000-memory.dmp
          Download

          memory/728-345-0x0000000005E10000-0x0000000005E73000-memory.dmp
          Download

          memory/728-344-0x0000000005950000-0x0000000005982000-memory.dmp
          Download

          memory/956-1259-0x000001C6C3D50000-0x000001C6C3D58000-memory.dmp
          Download

          memory/1636-1268-0x00000304D4B70000-0x00000304D4B7C000-memory.dmp
          Download

          memory/1636-1267-0x00000304D4B60000-0x00000304D4B68000-memory.dmp
          Download

          memory/2184-250-0x000000001B4E0000-0x000000001B502000-memory.dmp
          Download

          memory/2184-695-0x000000001BC80000-0x000000001BC88000-memory.dmp
          Download

          memory/2184-140-0x000000001AA50000-0x000000001ACAA000-memory.dmp
          Download

          memory/2184-296-0x000000001B6F0000-0x000000001B724000-memory.dmp
          Download

          memory/2184-136-0x0000000000F50000-0x0000000000F5A000-memory.dmp
          Download

          memory/2184-173-0x000000001BC90000-0x000000001C72E000-memory.dmp
          Download

          memory/2184-251-0x000000001B4B0000-0x000000001B4C8000-memory.dmp
          Download

          memory/2184-168-0x000000001A900000-0x000000001A90A000-memory.dmp
          Download

          memory/2184-196-0x000000001A980000-0x000000001A9B2000-memory.dmp
          Download

          memory/2184-213-0x000000001B730000-0x000000001B9E2000-memory.dmp
          Download

          memory/2184-138-0x000000001A740000-0x000000001A7F0000-memory.dmp
          Download

          memory/2184-377-0x000000001D670000-0x000000001DB98000-memory.dmp
          Download

          memory/2184-694-0x00000000014E0000-0x00000000014EC000-memory.dmp
          Download

          memory/2184-247-0x000000001C890000-0x000000001C9E8000-memory.dmp
          Download

          memory/2184-242-0x000000001A940000-0x000000001A952000-memory.dmp
          Download

          memory/2184-241-0x000000001A910000-0x000000001A93A000-memory.dmp
          Download

          memory/2184-240-0x000000001B470000-0x000000001B4AA000-memory.dmp
          Download

          memory/2184-239-0x000000001BB00000-0x000000001BC0A000-memory.dmp
          Download

          memory/2184-238-0x000000001AA10000-0x000000001AA4C000-memory.dmp
          Download

          memory/2184-141-0x000000001A970000-0x000000001A980000-memory.dmp
          Download

          memory/2184-235-0x000000001B630000-0x000000001B6E2000-memory.dmp
          Download

          memory/2184-232-0x000000001A9C0000-0x000000001AA10000-memory.dmp
          Download

          memory/2184-702-0x000000001A970000-0x000000001A980000-memory.dmp
          Download

          memory/2184-506-0x000000001D410000-0x000000001D49A000-memory.dmp
          Download

          memory/2184-509-0x000000001D2E0000-0x000000001D302000-memory.dmp
          Download

          memory/2184-521-0x000000001D2B0000-0x000000001D2BC000-memory.dmp
          Download

          memory/2184-522-0x000000001D4A0000-0x000000001D4AA000-memory.dmp
          Download

          memory/2184-208-0x000000001B3F0000-0x000000001B466000-memory.dmp
          Download

          memory/2184-227-0x000000001B550000-0x000000001B62C000-memory.dmp
          Download

          memory/3764-1656-0x0000024F09E70000-0x0000024F09E7C000-memory.dmp
          Download

          memory/4336-1659-0x0000016EE7260000-0x0000016EE7268000-memory.dmp
          Download

          memory/4336-1645-0x0000016EE74C0000-0x0000016EE74CA000-memory.dmp
          Download

          memory/4336-1663-0x0000016EE7250000-0x0000016EE7258000-memory.dmp
          Download

          memory/4336-1642-0x0000016EE72B0000-0x0000016EE7365000-memory.dmp
          Download

          memory/4336-1643-0x0000016EE7370000-0x0000016EE737A000-memory.dmp
          Download

          memory/4336-1644-0x0000016EE74E0000-0x0000016EE74FC000-memory.dmp
          Download

          memory/4336-1662-0x0000016ECE7F0000-0x0000016ECE7FC000-memory.dmp
          Download

          memory/4336-1641-0x0000016EE7290000-0x0000016EE72AC000-memory.dmp
          Download

          memory/4340-1658-0x000001F53DC80000-0x000001F53DC8C000-memory.dmp
          Download

          memory/4384-1390-0x000001B0409D0000-0x000001B0409D8000-memory.dmp
          Download

          memory/4696-170-0x0000000000400000-0x000000000044E000-memory.dmp
          Download

          memory/4696-0-0x0000000000438000-0x0000000000439000-memory.dmp
          Download

          memory/4696-54-0x0000000000400000-0x000000000044E000-memory.dmp
          Download

          memory/4696-78-0x0000000002F90000-0x0000000002FC0000-memory.dmp
          Download

          memory/4696-116-0x0000000002FA0000-0x0000000002FB3000-memory.dmp
          Download

          memory/4932-697-0x0000000005B50000-0x0000000005BB3000-memory.dmp
          Download

          memory/4932-230-0x00000000069B0000-0x0000000006FC8000-memory.dmp
          Download

          memory/4932-277-0x0000000006750000-0x00000000067A6000-memory.dmp
          Download

          memory/4932-149-0x0000000005210000-0x00000000052C0000-memory.dmp
          Download

          memory/4932-150-0x0000000005660000-0x0000000005670000-memory.dmp
          Download

          memory/4932-901-0x0000000005660000-0x0000000005670000-memory.dmp
          Download

          memory/4932-696-0x00000000059D0000-0x0000000005A02000-memory.dmp
          Download

          memory/4932-276-0x00000000066D0000-0x0000000006746000-memory.dmp
          Download

          memory/4932-221-0x0000000006030000-0x0000000006384000-memory.dmp
          Download

          memory/4932-146-0x0000000000630000-0x0000000000840000-memory.dmp
          Download

          memory/4932-499-0x000000000A7B0000-0x000000000A87E000-memory.dmp
          Download

          memory/4932-497-0x000000000B130000-0x000000000BBCE000-memory.dmp
          Download

          memory/4932-249-0x0000000007580000-0x0000000007B24000-memory.dmp
          Download

          memory/4932-374-0x000000000A530000-0x000000000A53A000-memory.dmp
          Download

          memory/4932-353-0x000000000A540000-0x000000000A590000-memory.dmp
          Download

          memory/4932-253-0x00000000065B0000-0x0000000006642000-memory.dmp
          Download

          memory/4932-257-0x0000000006FD0000-0x000000000722A000-memory.dmp
          Download

          memory/4932-310-0x00000000074A0000-0x00000000074AA000-memory.dmp
          Download

          memory/4948-1397-0x0000021F05410000-0x0000021F05418000-memory.dmp
          Download