Overview

overview

8

Static

static

8

AgentSetup...ed.exe

windows10-2004-x64

8

AgentSetup...ed.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-ltsc_2024-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-ltsc_2024-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-ltsc_2024-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-ltsc_2024-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-ltsc_2024-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-ltsc_2024-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-ltsc_2024-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AgentSetup_Prodigy_Office_Managed.exe
  • Size 18.3MB
  • Sample260712-pc6htsbv7s
  • SHA256 714ae46b9c83796f333e4a7b430f2612f99c88ada0ac7a5d38c109e42bb2a42a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 13 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • DattoRMM remote administration tool 1 IoCs

    DattoRMM is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 35 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 39 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\AgentSetup_Prodigy_Office_Managed.exe
    "C:\Users\Admin\AppData\Local\Temp\AgentSetup_Prodigy_Office_Managed.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6056
  • C:\Program Files (x86)\CentraStage\CagService.exe
    "C:\Program Files (x86)\CentraStage\CagService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\regsvr32.exe
        /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5964
    • C:\ProgramData\CentraStage\Temp\36eed94e-3780-4b54-850e-5fd90726d914\AEMAgent.exe
      "C:\ProgramData\CentraStage\Temp\36eed94e-3780-4b54-850e-5fd90726d914\AEMAgent.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2732
    • C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
      "C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"
      2⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5876
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="AEMAgent"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2636
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4112
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:3784
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Drops file in Windows directory
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:4376
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:5272
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Aria"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4840
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4968
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 15.0.1.11713"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:5952
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 15.0.1.11713" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.0.1.11713\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:8
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 15.0.1.11713" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.0.1.11713\RMM.WebRemote.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:5328
      • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.0.1.11713\RMM.WebRemote.exe
        "C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.0.1.11713\RMM.WebRemote.exe" --web-remote-daemon aemwr-c9430dac-793a-46af-89f8-f3a72678262d
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
      • C:\Windows\system32\netsh.exe
        "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • Modifies data under HKEY_USERS
        PID:5684
    • C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall delete rule name="RMM WINVNC"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:1888
    • C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule name="RMM WINVNC" dir=out action=block program="C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:3192
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\CentraStage\UltraVNC\vnc_configure.cmd" C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Windows\System32\sc.exe
        SC QUERY uvnc_service
        3⤵
        • Launches sc.exe
        PID:4444
      • C:\Windows\System32\tasklist.exe
        tasklist /fi "imagename eq winvnc.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
      • C:\Windows\System32\find.exe
        find ":"
        3⤵
          PID:3700
        • C:\Windows\System32\sc.exe
          SC create uvnc_service binpath= "\"C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe\" -service" start= auto
          3⤵
          • Launches sc.exe
          PID:4104
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1200

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          4
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          1
          T1553.004

          SIP and Trust Provider Hijacking

          1
          T1553.003

          Credential Access

          Discovery

          Process Discovery

          1
          T1057

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AxInterop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
          • Size 240KB
          • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AxInterop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
          • Size 40KB
          • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CSIcon.ico
          • Path C:\Program Files (x86)\CentraStage\CSIcon.ico
          • Size 27KB
          • SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe
          • Path C:\Program Files (x86)\CentraStage\CagService.exe
          • Size 19KB
          • SHA256 44e30d3f7ab5541a219765d7b4b3c3e459b18d0731dcb2dc694247b93517a6e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe.config
          • Path C:\Program Files (x86)\CentraStage\CagService.exe.config
          • Size 3KB
          • SHA256 cfb28ea4518ae77286a48b1581c9f1aa3c9851f0b3a306d175f0f62da903e1b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Common.dll
          • Path C:\Program Files (x86)\CentraStage\Common.dll
          • Size 16KB
          • SHA256 0c1060cc978894096c7d876eb09367a9f95faf8181c33bbfa0f606a8bf7ddaf9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.XmlSerializers.dll
          • Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
          • Size 10.6MB
          • SHA256 1dd793e15b430b09b99333817e010cc8894e69e29c0c9029da54f67886896cd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.dll
          • Path C:\Program Files (x86)\CentraStage\Core.dll
          • Size 2.4MB
          • SHA256 8728fe37cd9dac68f23bc376ae5a7001b78482920694a6b6f968295ff57b6cae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Core.dll
          • Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
          • Size 1.3MB
          • SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FsLexYacc.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
          • Size 69KB
          • SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe
          • Path C:\Program Files (x86)\CentraStage\Gui.exe
          • Size 2.1MB
          • SHA256 3325fc4401ec5634bd729592bfae5f56db174bfde39f026921b74ca7439b32e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe.config
          • Path C:\Program Files (x86)\CentraStage\Gui.exe.config
          • Size 5KB
          • SHA256 fd789235cf85da8aeb6294cfd5a8c07438909321e50f8a5f81821d0ca48626b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ICSharpCode.SharpZipLib.dll
          • Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
          • Size 196KB
          • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
          • Size 468KB
          • SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
          • Size 76KB
          • SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Size 46KB
          • SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
          • Size 30KB
          • SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
          • Size 36KB
          • SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Web.Services3.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
          • Size 864KB
          • SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NLog.config
          • Path C:\Program Files (x86)\CentraStage\NLog.config
          • Size 2KB
          • SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NLog.dll
          • Path C:\Program Files (x86)\CentraStage\NLog.dll
          • Size 678KB
          • SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
          • Size 528KB
          • SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Snmp.dll
          • Path C:\Program Files (x86)\CentraStage\Snmp.dll
          • Size 178KB
          • SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SnmpSharpNet.dll
          • Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
          • Size 108KB
          • SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.IO.dll
          • Path C:\Program Files (x86)\CentraStage\System.IO.dll
          • Size 20KB
          • SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
          • Size 21KB
          • SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Tasks.dll
          • Path C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll
          • Size 34KB
          • SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Transitions.dll
          • Path C:\Program Files (x86)\CentraStage\Transitions.dll
          • Size 17KB
          • SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ultravnc.ini
          • Path C:\Program Files (x86)\CentraStage\UltraVNC\ultravnc.ini
          • Size 1KB
          • SHA256 e27a573bde4f013b9c4aa8cd2c71ca9530e63f50a0e7de82dc359aaffdebe153
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Vim25Service.XmlSerializers.dll
          • Path C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll
          • Size 8.5MB
          • SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Vim25Service.dll
          • Path C:\Program Files (x86)\CentraStage\Vim25Service.dll
          • Size 2.7MB
          • SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WeifenLuo.WinFormsUI.Docking.dll
          • Path C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll
          • Size 402KB
          • SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsAgent.dll
          • Path C:\Program Files (x86)\CentraStage\WindowsAgent.dll
          • Size 449KB
          • SHA256 1bb38ec8ffae084779646674502452c998fec05a7955d5db67dacb949059181b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 460B
          • SHA256 396b40c9ef24899bc48eb6bae78a306cc8cdeb7c9e235200348e2a0f4b57a788
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 543B
          • SHA256 06186242eca665d82c1b03d16413cb46f57b13d982fc147c518430ae0f4c874b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 5KB
          • SHA256 9d415c90753e1d71181ac1d4587e027f82bf87f7bb01f5c861b906bee99488ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scvncctrl.dll
          • Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
          • Size 1.8MB
          • SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgentDeploy.netcore-win-x64.15.0.0.10817.2.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgentDeploy.netcore-win-x64.15.0.0.10817.2.zip
          • Size 11.5MB
          • SHA256 a4fae32b708736f4b431199a902d133b2f2fdb7a15ac43bf4243aaca37669a8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RMM.WebRemote.exe
          • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.0.1.11713\RMM.WebRemote.exe
          • Size 150KB
          • SHA256 a595bd4c61414438421653987c5d766e124fafb12dd3921170ff21e146ee8543
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 264B
          • SHA256 5323ea0c2b976cd01692b633b5e9b2de55736fc1dabf73d4fc9bd87bef392709
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 541B
          • SHA256 caad5b8dc8433e1d79076e0e59020d9948086b887525a71e69c1c86655c57a8a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows_agentrto.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
          • Size 26KB
          • SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeoffline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
          • Size 23KB
          • SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeonline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
          • Size 27KB
          • SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_offline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_offline.ico
          • Size 20KB
          • SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_ondemandmode.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_ondemandmode.ico
          • Size 25KB
          • SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_privacymode.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
          • Size 26KB
          • SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_stopped.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
          • Size 21KB
          • SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgent.exe
          • Path C:\ProgramData\CentraStage\Temp\36eed94e-3780-4b54-850e-5fd90726d914\AEMAgent.exe
          • Size 150KB
          • SHA256 fecf6a8a1e837004aa067d96b82743dbe0c9b6bac3205d077c26abe797762e94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.runtime
          • Path C:\ProgramData\CentraStage\Temp\36eed94e-3780-4b54-850e-5fd90726d914\dotnet.runtime
          • Size 291B
          • SHA256 21f6f833533032cb64fbc880c9470f1d895108f2622ec4500c4411f44aee5671
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          grv1wokc.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11915.11915\grv1wokc.newcfg
          • Size 1KB
          • SHA256 a04d3d6eeed97ced428cd34fc18509ca0cb8e093fc42e364d7dc2c71c438ca31
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          r5utjzet.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11915.11915\r5utjzet.newcfg
          • Size 494B
          • SHA256 b0fb0b2a8dd4aaa8fa35a1a2d056201bf99f58b3bec1f8db7b6968b8f1d862ba
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11915.11915\user.config
          • Size 344B
          • SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SimpleFC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\SimpleFC.dll
          • Size 175KB
          • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SimpleSC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\SimpleSC.dll
          • Size 61KB
          • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\System.dll
          • Size 11KB
          • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nsSCM.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\nsSCM.dll
          • Size 5KB
          • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsisXML.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsw39A5.tmp\nsisXML.dll
          • Size 11KB
          • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3gjc0dor.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\3gjc0dor.newcfg
          • Size 2KB
          • SHA256 bb2fb14e36331721dc67158e866cb3264a5d3b743a5230303d1ae98ac1b1b6a4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ducp43p1.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\ducp43p1.newcfg
          • Size 2KB
          • SHA256 148be6818cab1bb8dfe87973efae0844f109f35a592d9da49c665d035df8237d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nunuglpm.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\nunuglpm.newcfg
          • Size 313B
          • SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          p25tplpq.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\p25tplpq.newcfg
          • Size 438B
          • SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          swq4rnau.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\swq4rnau.newcfg
          • Size 2KB
          • SHA256 951970fa4b6e3da78dc250ca299b5b160f5573a3b31bb9ca030999cacdaccabf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ugglsm4h.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\ugglsm4h.newcfg
          • Size 2KB
          • SHA256 3782113e7b9d7cc6267c6f8b0ca74c123330601a0f5a5b15cf41d03090cca848
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\user.config
          • Size 313B
          • SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\user.config
          • Size 856B
          • SHA256 88f1d12df21fcfb22ac7f66c8d607f352ae1e8a6d0d9d9a026c65e76e8e6bb29
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ysapkpe1.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11915.11915\ysapkpe1.newcfg
          • Size 2KB
          • SHA256 8ccd7cccfacf87f2db44c6f7c3c99f51abf902a3a23c730c70fdbb5a5e62b6cb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1200-189-0x0000000005B40000-0x0000000005BD2000-memory.dmp
          Download

          memory/1200-511-0x0000000074210000-0x00000000749CC000-memory.dmp
          Download

          memory/1200-201-0x0000000005C60000-0x0000000005CD6000-memory.dmp
          Download

          memory/1200-203-0x0000000074210000-0x00000000749CC000-memory.dmp
          Download

          memory/1200-197-0x0000000074222000-0x0000000074223000-memory.dmp
          Download

          memory/1200-202-0x0000000005CE0000-0x0000000005D36000-memory.dmp
          Download

          memory/1200-188-0x0000000006AE0000-0x000000000709A000-memory.dmp
          Download

          memory/1200-347-0x000000000A640000-0x000000000A690000-memory.dmp
          Download

          memory/1200-363-0x0000000009020000-0x000000000902A000-memory.dmp
          Download

          memory/1200-192-0x0000000006520000-0x000000000678E000-memory.dmp
          Download

          memory/1200-510-0x0000000074222000-0x0000000074223000-memory.dmp
          Download

          memory/1200-164-0x0000000005F00000-0x0000000006518000-memory.dmp
          Download

          memory/1200-549-0x000000000B250000-0x000000000BCEE000-memory.dmp
          Download

          memory/1200-162-0x0000000005580000-0x00000000058DB000-memory.dmp
          Download

          memory/1200-550-0x000000000A880000-0x000000000A94E000-memory.dmp
          Download

          memory/1200-156-0x0000000005040000-0x00000000050F0000-memory.dmp
          Download

          memory/1200-153-0x0000000000480000-0x000000000069E000-memory.dmp
          Download

          memory/1200-266-0x0000000006A60000-0x0000000006A6A000-memory.dmp
          Download

          memory/2564-184-0x0000000000400000-0x000000000044E000-memory.dmp
          Download

          memory/2564-0-0x0000000000438000-0x0000000000439000-memory.dmp
          Download

          memory/2564-60-0x0000000000400000-0x000000000044E000-memory.dmp
          Download

          memory/2564-84-0x0000000002650000-0x0000000002680000-memory.dmp
          Download

          memory/2564-122-0x0000000002650000-0x0000000002663000-memory.dmp
          Download

          memory/3080-194-0x0000000001170000-0x000000000117A000-memory.dmp
          Download

          memory/3080-508-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-268-0x0000000001180000-0x00000000011AA000-memory.dmp
          Download

          memory/3080-256-0x0000000019EF0000-0x0000000019F40000-memory.dmp
          Download

          memory/3080-267-0x000000001A960000-0x000000001A99A000-memory.dmp
          Download

          memory/3080-264-0x000000001B0B0000-0x000000001B1BA000-memory.dmp
          Download

          memory/3080-384-0x000000001C4B0000-0x000000001C53A000-memory.dmp
          Download

          memory/3080-388-0x000000001CB70000-0x000000001D098000-memory.dmp
          Download

          memory/3080-262-0x000000001A920000-0x000000001A95C000-memory.dmp
          Download

          memory/3080-509-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-252-0x000000001AB00000-0x000000001ABDC000-memory.dmp
          Download

          memory/3080-245-0x000000001ACE0000-0x000000001AF92000-memory.dmp
          Download

          memory/3080-244-0x000000001A9A0000-0x000000001AA16000-memory.dmp
          Download

          memory/3080-222-0x000000001B1C0000-0x000000001BC5E000-memory.dmp
          Download

          memory/3080-196-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-195-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-275-0x000000001AA20000-0x000000001AA42000-memory.dmp
          Download

          memory/3080-505-0x000000001BDB0000-0x000000001BDBA000-memory.dmp
          Download

          memory/3080-297-0x000000001AA90000-0x000000001AAC4000-memory.dmp
          Download

          memory/3080-504-0x000000001BDA0000-0x000000001BDAC000-memory.dmp
          Download

          memory/3080-259-0x000000001ABE0000-0x000000001AC92000-memory.dmp
          Download

          memory/3080-187-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-269-0x0000000019BD0000-0x0000000019BE2000-memory.dmp
          Download

          memory/3080-513-0x000000001C940000-0x000000001C962000-memory.dmp
          Download

          memory/3080-183-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-165-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-163-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-159-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-158-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-151-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-150-0x0000000019F60000-0x000000001A1CE000-memory.dmp
          Download

          memory/3080-147-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
          Download

          memory/3080-145-0x0000000019C40000-0x0000000019CF0000-memory.dmp
          Download

          memory/3080-141-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp
          Download

          memory/3080-143-0x0000000000270000-0x000000000027A000-memory.dmp
          Download

          memory/3080-235-0x0000000019B90000-0x0000000019BC2000-memory.dmp
          Download

          memory/3080-274-0x000000001BDC0000-0x000000001BF18000-memory.dmp
          Download

          memory/3080-276-0x0000000019BF0000-0x0000000019C08000-memory.dmp
          Download