Overview

overview

8

Static

static

8

AgentSetup...a2.exe

windows10-2004-x64

8

AgentSetup...a2.exe

windows11-21h2-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 18:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AgentSetup_Document1214a2.exe
  • Size 10.5MB
  • Sample260504-w4psqaex4l
  • SHA256 015f182d2aa1edfa79a7d505cd9fdbdbf6f4ef8ef5b02d377e359e1de9fd2d3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 11 IoCs
    defense_evasion
  • DattoRMM remote administration tool 1 IoCs

    DattoRMM is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 15 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\AgentSetup_Document1214a2.exe
    "C:\Users\Admin\AppData\Local\Temp\AgentSetup_Document1214a2.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1280
  • C:\Program Files (x86)\CentraStage\CagService.exe
    "C:\Program Files (x86)\CentraStage\CagService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\regsvr32.exe
        /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:564
    • C:\ProgramData\CentraStage\Temp\e47d9d6f-df21-4506-a020-2e9970ddecf1\AEMAgent.exe
      "C:\ProgramData\CentraStage\Temp\e47d9d6f-df21-4506-a020-2e9970ddecf1\AEMAgent.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2616
    • C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
      "C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"
      2⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3148
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="AEMAgent"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2600
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3884
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:1984
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Drops file in Windows directory
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:2416
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:4932
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Aria"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3848
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3768
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 14.9.1.11030"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4004
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 14.9.1.11030" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4256
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 14.9.1.11030" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:1688
      • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe
        "C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe" --web-remote-daemon aemwr-4a2511c6-2e51-425f-9fbf-916189376ab1
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -executionpolicy bypass & 'C:\ProgramData\CentraStage\Packages\54be6a93-f41c-480e-b187-14aae55733dc#\command.ps1'
      2⤵
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\TEMP\F0D4A433-6735-4E0E-A082-5A77F245B694\dismhost.exe
        C:\Windows\TEMP\F0D4A433-6735-4E0E-A082-5A77F245B694\dismhost.exe {C07BC2C6-253C-44F1-AE29-93A39E981B3B}
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2044
  • C:\Program Files (x86)\CentraStage\Gui.exe
    "C:\Program Files (x86)\CentraStage\Gui.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2496

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Modify Registry

        4
        T1112

        Subvert Trust Controls

        2
        T1553

        Install Root Certificate

        1
        T1553.004

        SIP and Trust Provider Hijacking

        1
        T1553.003

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AxInterop.MSTSCLib.dll
        • Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
        • Size 240KB
        • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AxInterop.ViewerX.dll
        • Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
        • Size 40KB
        • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CSIcon.ico
        • Path C:\Program Files (x86)\CentraStage\CSIcon.ico
        • Size 27KB
        • SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CagService.exe
        • Path C:\Program Files (x86)\CentraStage\CagService.exe
        • Size 19KB
        • SHA256 06d34513b05a11e0c7d353035d441d4a28d1682ecb6d3cc43816bd378ab14fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CagService.exe.config
        • Path C:\Program Files (x86)\CentraStage\CagService.exe.config
        • Size 3KB
        • SHA256 d4f623edb068538f8c814dae2b3db6444d440c16b8eb6bf5d54db8a461f76a1f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Common.dll
        • Path C:\Program Files (x86)\CentraStage\Common.dll
        • Size 16KB
        • SHA256 b3dd496b276e315079754781cc8e92b1ff55411717f3fbbb213e21ed1c107040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Core.XmlSerializers.dll
        • Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
        • Size 10.6MB
        • SHA256 5291a543ffa861bb0a41c1c5702244cb79d9158b24f80174725c45bd77e9ee46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Core.dll
        • Path C:\Program Files (x86)\CentraStage\Core.dll
        • Size 2.3MB
        • SHA256 2637e4c7fb3df53c75d2dc1b44f7ffd782197ce3a28826671803d1fe389bcf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FSharp.Core.dll
        • Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
        • Size 1.3MB
        • SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FsLexYacc.Runtime.dll
        • Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
        • Size 69KB
        • SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Gui.exe
        • Path C:\Program Files (x86)\CentraStage\Gui.exe
        • Size 2.0MB
        • SHA256 4f405ab4adfc0d397f7137ee9bbf7e9a215c311cf120cb78ea261e1abcbdeb21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Gui.exe.config
        • Path C:\Program Files (x86)\CentraStage\Gui.exe.config
        • Size 5KB
        • SHA256 71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ICSharpCode.SharpZipLib.dll
        • Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
        • Size 196KB
        • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Interop.MSTSCLib.dll
        • Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
        • Size 468KB
        • SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Interop.ViewerX.dll
        • Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
        • Size 76KB
        • SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.Extensions.Desktop.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
        • Size 46KB
        • SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.Extensions.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
        • Size 30KB
        • SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Threading.Tasks.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
        • Size 36KB
        • SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Web.Services3.dll
        • Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
        • Size 864KB
        • SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NLog.config
        • Path C:\Program Files (x86)\CentraStage\NLog.config
        • Size 2KB
        • SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NLog.dll
        • Path C:\Program Files (x86)\CentraStage\NLog.dll
        • Size 678KB
        • SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
        • Size 528KB
        • SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Snmp.dll
        • Path C:\Program Files (x86)\CentraStage\Snmp.dll
        • Size 178KB
        • SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SnmpSharpNet.dll
        • Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
        • Size 108KB
        • SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.dll
        • Path C:\Program Files (x86)\CentraStage\System.IO.dll
        • Size 20KB
        • SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
        • Size 21KB
        • SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Tasks.dll
        • Path C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll
        • Size 34KB
        • SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Transitions.dll
        • Path C:\Program Files (x86)\CentraStage\Transitions.dll
        • Size 17KB
        • SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Vim25Service.XmlSerializers.dll
        • Path C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll
        • Size 8.5MB
        • SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Vim25Service.dll
        • Path C:\Program Files (x86)\CentraStage\Vim25Service.dll
        • Size 2.7MB
        • SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WeifenLuo.WinFormsUI.Docking.dll
        • Path C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll
        • Size 402KB
        • SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsAgent.dll
        • Path C:\Program Files (x86)\CentraStage\WindowsAgent.dll
        • Size 446KB
        • SHA256 32ec64ce65fb79886222d399973ce609297a9c8ba567cb9a0d0ceaf396e8dabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Program Files (x86)\CentraStage\log.txt
        • Size 4KB
        • SHA256 b6a79a1b0fe53663e12cd8b4f40a44d6b80af263fcdae87f828ab1ba5338469a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Program Files (x86)\CentraStage\log.txt
        • Size 5KB
        • SHA256 59dc6dbc0756ebbc0c728f7fce40cc2e0356a8838c8852067567294b3ad4e660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Program Files (x86)\CentraStage\log.txt
        • Size 5KB
        • SHA256 a6196281cf0fec2c297fc80887e21855415acbf6576019b7ecbbb655e60addd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        scvncctrl.dll
        • Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
        • Size 1.8MB
        • SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AEMAgentDeploy.netcore-win-x64.14.9.0.10646.2.zip
        • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgentDeploy.netcore-win-x64.14.9.0.10646.2.zip
        • Size 11.2MB
        • SHA256 c5b1800f909a6bd98a61391575159af7faebdf456f1099f34e9452c54319a77b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        webremote.log
        • Path C:\ProgramData\CentraStage\AEMAgent\DataLog\webremote.log
        • Size 4KB
        • SHA256 116301784f692f1f98c30a2630f48008d8bdfb3663af81b17a8c8f9df09b1228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RMM.WebRemote.exe
        • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.9.1.11030\RMM.WebRemote.exe
        • Size 150KB
        • SHA256 3d12d6d8a118a2ddc43234c28fe36daa477d293bf48494965b1713b20c3f5cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Settings.json
        • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
        • Size 723B
        • SHA256 e0acb0e142df0e95f47f0f2d6c65465b0632f690cd5ecb64ad2f6435625b1d8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Settings.json
        • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
        • Size 433B
        • SHA256 711df23b68aff8bc2a9af9e1aa957e6e02c67483d9d563367c997ce0aa2a0b04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        windows_agentrto.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
        • Size 26KB
        • SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_alertmodeoffline.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
        • Size 23KB
        • SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_alertmodeonline.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
        • Size 27KB
        • SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_offline.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_offline.ico
        • Size 20KB
        • SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_ondemandmode.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_ondemandmode.ico
        • Size 25KB
        • SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_privacymode.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
        • Size 26KB
        • SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows_stopped.ico
        • Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
        • Size 21KB
        • SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MonitorAlerts.xml
        • Path C:\ProgramData\CentraStage\Monitoring\MonitorAlerts.xml
        • Size 165B
        • SHA256 820260de7d48b85eb8e3358a8d54f6bbf01ddc2fe68a8bca154045d6a5ed31d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AEMAgent.exe
        • Path C:\ProgramData\CentraStage\Temp\e47d9d6f-df21-4506-a020-2e9970ddecf1\AEMAgent.exe
        • Size 150KB
        • SHA256 275150650e0683d08a2f90fe144aa3c220a38c001f34382167a0566c7d8ee6df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.runtime
        • Path C:\ProgramData\CentraStage\Temp\e47d9d6f-df21-4506-a020-2e9970ddecf1\dotnet.runtime
        • Size 291B
        • SHA256 21f6f833533032cb64fbc880c9470f1d895108f2622ec4500c4411f44aee5671
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 4KB
        • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 342B
        • SHA256 4b3121a6c156e124b1b4bf5d8475fe4b2d03bdfe8e733962d7b268e2d46f4a58
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dzdptbk0.newcfg
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\dzdptbk0.newcfg
        • Size 1KB
        • SHA256 1411195cf15369065e0b241be5532ee0612180841d48490902c99eecbeb9b71e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        glhfbzhq.newcfg
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\glhfbzhq.newcfg
        • Size 495B
        • SHA256 688e5373caded7397ed9c39195cc8efa42863fff2cca27bc3d8d45bff09e4ae0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\user.config
        • Size 344B
        • SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SimpleFC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\SimpleFC.dll
        • Size 175KB
        • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SimpleSC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\SimpleSC.dll
        • Size 61KB
        • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsSCM.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\nsSCM.dll
        • Size 5KB
        • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsisXML.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa51D.tmp\nsisXML.dll
        • Size 11KB
        • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 289KB
        • SHA256 c4b5f3b401cba062b7ca252cd1fce60f6ca7b7bfc625aa35a157d0bec2ba7655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0tqdazby.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\0tqdazby.newcfg
        • Size 2KB
        • SHA256 7e3f1eb91b9a0db5500c779b7ed96f5bbdd8bd0489b28511302aa3f30d07f966
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        33eikcds.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\33eikcds.newcfg
        • Size 725B
        • SHA256 d34e873796f79cb88d4b0ccde8c0a31e02fd4d2d09ec83dac82a5db0ff535f03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d5yrgkpu.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\d5yrgkpu.newcfg
        • Size 2KB
        • SHA256 affefa8072d45b0de446c3a10ae57c178d95c73103c7b18bfe2f459e7126fc9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ddofyfn2.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\ddofyfn2.newcfg
        • Size 2KB
        • SHA256 bca88cfb31de568eb6dcfb678ec14e2f2548492aae760806655863596df1b6cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fhwtzodw.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\fhwtzodw.newcfg
        • Size 2KB
        • SHA256 160827656dcb9ce8d6ee4c86d9a2b98dd093257c918447fdf714670fa87cbbed
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        retfq5ug.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\retfq5ug.newcfg
        • Size 438B
        • SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sci5uwb2.newcfg
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\sci5uwb2.newcfg
        • Size 313B
        • SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
        • Size 3KB
        • SHA256 e17e7e51f7fed3a78aef97ef0b6e85b9d52dbe142cea7c27ded3ac0e19c622d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
        • Size 2KB
        • SHA256 cb0c0fb84b794d3d5e92716c9b02952543c6510e72a73ba4ff971c1e50dbb305
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
        • Size 313B
        • SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_dee1jc5w.rux.ps1
        • Path C:\Windows\Temp\__PSScriptPolicyTest_dee1jc5w.rux.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/412-240-0x000000001A840000-0x000000001A862000-memory.dmp
        Download

        memory/412-202-0x000000001A710000-0x000000001A786000-memory.dmp
        Download

        memory/412-241-0x0000000019DC0000-0x0000000019DD8000-memory.dmp
        Download

        memory/412-239-0x000000001BAE0000-0x000000001BC38000-memory.dmp
        Download

        memory/412-192-0x0000000019D80000-0x0000000019DB2000-memory.dmp
        Download

        memory/412-228-0x00000000011D0000-0x00000000011E2000-memory.dmp
        Download

        memory/412-136-0x00000000001B0000-0x00000000001BA000-memory.dmp
        Download

        memory/412-138-0x0000000019AD0000-0x0000000019B80000-memory.dmp
        Download

        memory/412-140-0x0000000019DE0000-0x000000001A03A000-memory.dmp
        Download

        memory/412-143-0x0000000000AD0000-0x0000000000AE0000-memory.dmp
        Download

        memory/412-169-0x0000000001160000-0x000000000116A000-memory.dmp
        Download

        memory/412-225-0x000000001A7E0000-0x000000001A80A000-memory.dmp
        Download

        memory/412-223-0x000000001B9D0000-0x000000001BADA000-memory.dmp
        Download

        memory/412-224-0x000000001A4D0000-0x000000001A50A000-memory.dmp
        Download

        memory/412-222-0x000000001A490000-0x000000001A4CC000-memory.dmp
        Download

        memory/412-217-0x000000001AD10000-0x000000001ADC2000-memory.dmp
        Download

        memory/412-173-0x000000001AF30000-0x000000001B9CE000-memory.dmp
        Download

        memory/412-203-0x000000001AA50000-0x000000001AD02000-memory.dmp
        Download

        memory/412-655-0x0000000000AA0000-0x0000000000AAC000-memory.dmp
        Download

        memory/412-658-0x0000000000AD0000-0x0000000000AE0000-memory.dmp
        Download

        memory/412-656-0x0000000001190000-0x00000000011A2000-memory.dmp
        Download

        memory/412-270-0x000000001A990000-0x000000001A9C4000-memory.dmp
        Download

        memory/412-486-0x000000001C520000-0x000000001C5AA000-memory.dmp
        Download

        memory/412-489-0x000000001C4C0000-0x000000001C4E2000-memory.dmp
        Download

        memory/412-547-0x000000001CCE0000-0x000000001D208000-memory.dmp
        Download

        memory/412-214-0x000000001A790000-0x000000001A7E0000-memory.dmp
        Download

        memory/412-210-0x000000001A870000-0x000000001A94C000-memory.dmp
        Download

        memory/412-538-0x000000001AF10000-0x000000001AF1C000-memory.dmp
        Download

        memory/412-539-0x000000001AF00000-0x000000001AF0A000-memory.dmp
        Download

        memory/1128-166-0x0000000000400000-0x000000000044E000-memory.dmp
        Download

        memory/1128-116-0x00000000025F0000-0x0000000002603000-memory.dmp
        Download

        memory/1128-0-0x0000000000438000-0x0000000000439000-memory.dmp
        Download

        memory/1128-78-0x00000000025F0000-0x0000000002620000-memory.dmp
        Download

        memory/1128-54-0x0000000000400000-0x000000000044E000-memory.dmp
        Download

        memory/1280-268-0x0000000006D90000-0x00000000073A8000-memory.dmp
        Download

        memory/1280-1511-0x0000000006010000-0x0000000006093000-memory.dmp
        Download

        memory/1280-663-0x0000000006010000-0x0000000006093000-memory.dmp
        Download

        memory/1280-546-0x0000000009A60000-0x0000000009A6A000-memory.dmp
        Download

        memory/1280-327-0x0000000006C20000-0x0000000006C76000-memory.dmp
        Download

        memory/1280-326-0x0000000006BA0000-0x0000000006C16000-memory.dmp
        Download

        memory/1280-494-0x0000000009900000-0x0000000009950000-memory.dmp
        Download

        memory/1280-480-0x0000000009540000-0x000000000960E000-memory.dmp
        Download

        memory/1280-317-0x0000000007960000-0x0000000007F06000-memory.dmp
        Download

        memory/1280-351-0x0000000007F20000-0x0000000007F2A000-memory.dmp
        Download

        memory/1280-1391-0x0000000006010000-0x0000000006093000-memory.dmp
        Download

        memory/1280-477-0x0000000009F10000-0x000000000A9AE000-memory.dmp
        Download

        memory/1280-253-0x00000000063D0000-0x0000000006727000-memory.dmp
        Download

        memory/1280-321-0x00000000073B0000-0x000000000760A000-memory.dmp
        Download

        memory/1280-318-0x0000000006A80000-0x0000000006B12000-memory.dmp
        Download

        memory/2344-1605-0x0000022E7B7A0000-0x0000022E7B7AA000-memory.dmp
        Download

        memory/2344-1606-0x0000022E7B930000-0x0000022E7B956000-memory.dmp
        Download

        memory/2344-1817-0x0000022E7AD80000-0x0000022E7AD92000-memory.dmp
        Download

        memory/2344-1604-0x0000022E7B6E0000-0x0000022E7B793000-memory.dmp
        Download

        memory/2344-1816-0x0000022E7ABF0000-0x0000022E7ABFC000-memory.dmp
        Download

        memory/2344-1603-0x0000022E7B6C0000-0x0000022E7B6DC000-memory.dmp
        Download

        memory/2496-664-0x0000000005730000-0x0000000005740000-memory.dmp
        Download

        memory/2496-145-0x00000000007B0000-0x00000000009C0000-memory.dmp
        Download

        memory/2496-148-0x0000000005310000-0x00000000053C0000-memory.dmp
        Download

        memory/2496-150-0x0000000005730000-0x0000000005740000-memory.dmp
        Download

        memory/2496-1199-0x0000000005D10000-0x0000000005D93000-memory.dmp
        Download

        memory/2496-657-0x0000000005D10000-0x0000000005D93000-memory.dmp
        Download

        memory/3148-1376-0x000002DC5D400000-0x000002DC5D40C000-memory.dmp
        Download