2dc67607df963870acf8718568caada01da54344a674a641d6442012bbfd9759

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
210s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hansonagy.exe
Size 10.5MB
Sample260724-sd2g2sha94
SHA256 2dc67607df963870acf8718568caada01da54344a674a641d6442012bbfd9759
MD5 0e653dd395a4f0a95bf07f0b9272974e
SHA1 b91962dac0f402628910dd8c5f4faa25a0984e21
SHA512 666b0ee783000146d63143ac05a0bccdf1edddf999c52944d6213027b2f1666dea794e8622c9443614b2d85ef98a3874a10ec217ef9e3d5437f3a654eb9535db
SSDEEP 196608:vaZk+w1bLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzD3:nnpnkGkx08rtE7AnMGp29qIT0WzX
TLSH
T1AAB63307DE3B8EF4CB63463C89831A57124F598E8C47E4C9F0482A3549E799ADE38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery persistence rat spyware trojan

Malware Config

Signatures

DattoRMM remote administration tool 1 IoCs

DattoRMM is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000700000002847f-195.dat	rat_dattormm

Executes dropped EXE 3 IoCs

pid	Process
4864	CagService.exe
2568	Gui.exe
2692	Gui.exe

Loads dropped DLL 64 IoCs

pid	Process
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2568	Gui.exe
2568	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2568	Gui.exe
2568	Gui.exe
2568	Gui.exe
2568	Gui.exe
3252	regsvr32.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe
2692	Gui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CentraStage = "C:\\Program Files (x86)\\CentraStage\\Gui.exe"	hansonagy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\fkzsgbgd.tmp	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\2zxumys4.tmp	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\c31em10o.newcfg	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\fkzsgbgd.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\vdqnnboh.tmp	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\fkzsgbgd.newcfg	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\5tys1bh1.newcfg	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\2zxumys4.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\vdqnnboh.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\gmiktv4b.tmp	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\gmiktv4b.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\5tys1bh1.tmp	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\5tys1bh1.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\2zxumys4.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\c31em10o.tmp	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\c31em10o.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\f1mj1uap.tmp	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\f1mj1uap.newcfg	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config	CagService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\f1mj1uap.newcfg	CagService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\gmiktv4b.newcfg	CagService.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CentraStage\CagService.exe.config	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\CSIcon.ico	CagService.exe
File created	C:\Program Files (x86)\CentraStage\cagerrors.dat	CagService.exe
File created	C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Licenses.txt	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\fr\Gui.resources.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\hu\Gui.resources.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\CagService.exe	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\sv\Gui.resources.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\CagService.exe.config	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Gui.exe.config	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\de\Gui.resources.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Snmp.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\log.txt	CagService.exe
File created	C:\Program Files (x86)\CentraStage\Gui.exe	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\portName	CagService.exe
File created	C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\System.IO.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Vim25Service.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Core.dll	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\snmp.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\WindowsAgent.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\putty.exe	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\uninst.exe	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\portName	CagService.exe
File created	C:\Program Files (x86)\CentraStage\CSIcon.ico	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Common.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\FSharp.Core.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Transitions.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\nl\Gui.resources.dll	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\log.txt	Gui.exe
File created	C:\Program Files (x86)\CentraStage\defaultbrand.zip	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\NLog.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\scvncctrl.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\it\Gui.resources.dll	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\log.txt	CagService.exe
File opened for modification	C:\Program Files (x86)\CentraStage\cagerrors.dat	CagService.exe
File created	C:\Program Files (x86)\CentraStage\nlog.config	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\System.Runtime.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\CsExec.Service.exe	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\es\Gui.resources.dll	hansonagy.exe
File created	C:\Program Files (x86)\CentraStage\pt\Gui.resources.dll	hansonagy.exe
File opened for modification	C:\Program Files (x86)\CentraStage\log.txt	Gui.exe
File created	C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll	hansonagy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hansonagy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gui.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CagService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CagService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CagService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CagService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CagService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cag\shell	CagService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\InprocServer32\ = "C:\\Program Files (x86)\\CentraStage\\scvncctrl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\TypeLib\ = "{2864468C-765F-4EF3-B8CF-42666C92B545}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37A0E3B1-1AFD-4125-AB2E-2DE8F69DED39}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE105750-449E-4220-ADF5-AB8EF7D6906A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE105750-449E-4220-ADF5-AB8EF7D6906A}\TypeLib\ = "{2864468C-765F-4EF3-B8CF-42666C92B545}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE105750-449E-4220-ADF5-AB8EF7D6906A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE105750-449E-4220-ADF5-AB8EF7D6906A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\CentraStage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82B3A16E-4E01-467E-AED4-198EA092D3AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE105750-449E-4220-ADF5-AB8EF7D6906A}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.2\ = "SmartCode VNC Viewer Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0\ = "SmartCode ViewerX VNC Control v3.8.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82B3A16E-4E01-467E-AED4-198EA092D3AF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82B3A16E-4E01-467E-AED4-198EA092D3AF}\ = "ISmartCodeVNCViewer2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C35468F3-A938-4CB4-ADBB-D0BB37F504CA}\ = "ISmartCodeVNCViewer3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82B3A16E-4E01-467E-AED4-198EA092D3AF}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\cag	CagService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.2\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.1\CLSID\ = "{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX\ = "SmartCode VNC Viewer Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\TypeLib\ = "{2864468C-765F-4EF3-B8CF-42666C92B545}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82B3A16E-4E01-467E-AED4-198EA092D3AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.2\CLSID\ = "{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\ = "SmartCode VNC Viewer Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37A0E3B1-1AFD-4125-AB2E-2DE8F69DED39}\TypeLib\ = "{2864468C-765F-4EF3-B8CF-42666C92B545}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D2B76F9-B1F4-43B5-A207-F23EA608BA49}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C35468F3-A938-4CB4-ADBB-D0BB37F504CA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}\ = "IScVxAdvancedSettings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D2B76F9-B1F4-43B5-A207-F23EA608BA49}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\cag\shell\open\command\ = "\"C:\\Program Files (x86)\\CentraStage\\Gui.exe\" %1"	CagService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cag\URL Protocol	CagService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cag\shell\open	CagService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37A0E3B1-1AFD-4125-AB2E-2DE8F69DED39}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{200722C4-0B36-48F7-BACF-A9E7AD3D0A7E}\TypeLib\ = "{2864468C-765F-4EF3-B8CF-42666C92B545}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC783088-B1D2-4B2F-88CA-51B8ACC638B9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cag	CagService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.3\ = "SmartCode VNC Viewer Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\VersionIndependentProgID\ = "SmartCode.ViewerX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62FA83F7-20EC-4D62-AC86-BAB705EE1CCD}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\ = "_ISmartCodeVNCViewerEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartCode.ViewerX.3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2864468C-765F-4EF3-B8CF-42666C92B545}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{301C38CE-584C-4E08-A545-140A08892FB0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C35468F3-A938-4CB4-ADBB-D0BB37F504CA}\TypeLib	regsvr32.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b94b0000000100000044000000430038004500350033003400450045003100320039004600320037004400350035003400360030004300450031003700460044003600320038003200310036005f0000002000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Gui.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	Gui.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b94b0000000100000044000000430038004500350033003400450045003100320039004600320037004400350035003400360030004300450031003700460044003600320038003200310036005f0000002000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Gui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	Gui.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Gui.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	Gui.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	Gui.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2484	hansonagy.exe
2568	Gui.exe
2692	Gui.exe
4864	CagService.exe
4864	CagService.exe
4864	CagService.exe
4864	CagService.exe
4864	CagService.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	Gui.exe
Token: SeDebugPrivilege	4864	CagService.exe
Token: SeDebugPrivilege	2692	Gui.exe
Token: SeAssignPrimaryTokenPrivilege	4864	CagService.exe
Token: SeIncreaseQuotaPrivilege	4864	CagService.exe
Token: SeSecurityPrivilege	4864	CagService.exe
Token: SeTakeOwnershipPrivilege	4864	CagService.exe
Token: SeLoadDriverPrivilege	4864	CagService.exe
Token: SeSystemtimePrivilege	4864	CagService.exe
Token: SeBackupPrivilege	4864	CagService.exe
Token: SeRestorePrivilege	4864	CagService.exe
Token: SeShutdownPrivilege	4864	CagService.exe
Token: SeSystemEnvironmentPrivilege	4864	CagService.exe
Token: SeUndockPrivilege	4864	CagService.exe
Token: SeManageVolumePrivilege	4864	CagService.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2692	Gui.exe
2692	Gui.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2692	Gui.exe
2692	Gui.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2692	2484	hansonagy.exe	92
PID 4864 wrote to memory of 3532	4864	CagService.exe	94
PID 3532 wrote to memory of 3252	3532	regsvr32.exe	95

C:\Users\Admin\AppData\Local\Temp\hansonagy.exe
"C:\Users\Admin\AppData\Local\Temp\hansonagy.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\CentraStage\Gui.exe
  "C:\Program Files (x86)\CentraStage\Gui.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2692

C:\Program Files (x86)\CentraStage\CagService.exe
"C:\Program Files (x86)\CentraStage\CagService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3252

C:\Program Files (x86)\CentraStage\Gui.exe
"C:\Program Files (x86)\CentraStage\Gui.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AxInterop.MSTSCLib.dll

Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
Size 240KB
SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
MD5 0f581e56ed5ba500ce5d98d105b04a37
SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
TLSH
T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AxInterop.ViewerX.dll

Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
Size 40KB
SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
MD5 edc5e696c4ad70f0be6301f703ab3672
SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
TLSH
T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSIcon.ico

Path C:\Program Files (x86)\CentraStage\CSIcon.ico
Size 27KB
SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
MD5 2f6fd9aa57aa40728a65fa006c7e0f17
SHA1 ba8a966342a1485e5ee17097dabe252e2883fc42
SHA512 fd72df629894fa51bc394c7e05b0ea96490c753f2d4b143c0fdf05844503803cf5610810da78ceeb018963c3750185cd0b122b1863e4fb38bd5173ae8a76b138
SSDEEP 384:pr+Sw7yOFwk3DJlsUYhawY2yz/YLxL4roVBfnHCpb+G65s0Z:N+pl/3DJlsdRYzroVBPC976L
TLSH
T1B5C2E9C1FDD185D4EAB9BA3CD323D9F179A65154004AC9C0EAADBFB128B840A3F0DD95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CagService.exe

Path C:\Program Files (x86)\CentraStage\CagService.exe
Size 19KB
SHA256 06d34513b05a11e0c7d353035d441d4a28d1682ecb6d3cc43816bd378ab14fe5
MD5 74cc65ba2ca9a228472ea232ced0d26d
SHA1 75fa8c8d678e971e40e78dc136fe685bbfa70c4f
SHA512 a3e2438f2fbf908bb528ccbc634ad96da5acff7c4b961800fc3d103bfd14b0c7c8a6b59227c929fd5386a356bcf748492631939b5e783a96c2ae8de3a131a13d
SSDEEP 384:RYMQoLIU+94X9nmhJUJkJ7fHUQTJosEyZKm2j:6oLIi8nLUEmsfZKm
TLSH
T16292C701A3E88B2AF6F76F71597206050E72FE5BA871D75C36A4004E1AB3B80CD71776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CagService.exe.config

Path C:\Program Files (x86)\CentraStage\CagService.exe.config
Size 3KB
SHA256 95c22bb12388eae513399ac62ec8b8c8b23b3044ff03193fbd619645ba89162d
MD5 44925a341c7294253841e4edc8e2f949
SHA1 651f034f02b9b53d70c5ecea91e7a40b2106e2e4
SHA512 e998d4f1d079ed3a7b711dccb4177847189fcaf9ec79bc0b409164e17ba01768e5c8d273b6618c6924daab959c814123e4b95e28894caf0e5644fc28d8c903d7
TLSH
T1D381ED0472CD7F6E07422A33F83616D0927FDE27257850E8A4FE7077B9104972B62BA5
MD5 SHA1 SHA512 TLSH

Submit Download

Common.dll

Path C:\Program Files (x86)\CentraStage\Common.dll
Size 16KB
SHA256 b3dd496b276e315079754781cc8e92b1ff55411717f3fbbb213e21ed1c107040
MD5 b6032093b57dbdfc3a47ac10a5a92037
SHA1 5b9139ba19cc41a781c52ac1732d183dfbdc7384
SHA512 b7769c392faa589f3e489efed30c245be25b2631dc91ee273d80eaaa4990127a530e4657445255078bf54bd8f321bd444c7485e31790179367b121a6115475f9
SSDEEP 384:88RZI9AhN25kqsyORsdsvZvnD32sXdm2f:5ZI9AhIxUvZvD32sXdm
TLSH
T169720B648B78C33BC69A1A32F561CE6503F5574BB181CE9A8A14E85F6F033DA44099FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Core.XmlSerializers.dll

Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
Size 10.6MB
SHA256 5291a543ffa861bb0a41c1c5702244cb79d9158b24f80174725c45bd77e9ee46
MD5 9d79a6bb0c856f011d9abb2b8e82e9f9
SHA1 611b8fd6448c5a3c3a2522b9475a0ec822ef69f9
SHA512 720154e1fd5382c7ef5603483c155daa00952588402248cbfe918303d6511e591fac621bf5849586e1330d023efa3aff383a97b0739090ac7d2d2c4de8b6e4d4
SSDEEP 98304:/SigljwxvVN5irQ9eLi40jjX6OlfbrhHdrjqfsD2j7yc6uYuXZe00Nau:/SxljMvr5iccijjXblfnhJqf57o
TLSH
T1B6B62EC0B3E90F0BF9BF57A615715669A736BCDB468B92EC02D910696DF37007C902A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Core.dll

Path C:\Program Files (x86)\CentraStage\Core.dll
Size 2.3MB
SHA256 2637e4c7fb3df53c75d2dc1b44f7ffd782197ce3a28826671803d1fe389bcf48
MD5 9fcc6e99b81e5f5e0dbedee5cbbf61de
SHA1 216bb0585d99efd73dcde3edb9e2e6414573e6ed
SHA512 592db4f85057ef40260b608dba7c6591235e446e2f0d149d10e568d97abc9751ded90ee65083569c26e805de1688c03e4ce002c3b379ca86532beeda26e1fcd5
SSDEEP 24576:wj6kJQEYG4fx1e+l04FP0r0o28Uqeu0RQLDTH7/3YJN1ax84o9M5qtyxGX+JaZX6:MwGMKCVQLD33U1p9
TLSH
T1C3B5E91026B0AE9EC4684B7438290187B3FFD60F5779D36E57A0165E4FA6B0B8B13763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSharp.Core.dll

Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
Size 1.3MB
SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
MD5 99a817a04b25690b98edf3370ed2eb83
SHA1 1a878f0e4fb4f7ea1d75674eb724fc6feaccdff0
SHA512 a0eef9ee2f661a2cbacac61d975ca5e56e7213b38b1b5bf172ec590d9157d0d316435c7ff42c52d94cc4cdfbc26297babd73fdf2f209b6385070fb896337437b
SSDEEP 12288:AmksTXX3ieERl2EQOYqOsiunqhU16+wLpmuu6NXd+ib27fDiscy:bXHzEzPQOHiunqhU16+wG6xcib27fDZ
TLSH
T168555C0BFF84C392D0AF57BB84621349B760D2C193D3A74E329475E25CBB7A05DC92A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FsLexYacc.Runtime.dll

Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
Size 69KB
SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
MD5 06b971620bda7960f7d8e43ce69e3bbe
SHA1 08e1f37cd9c1d320fac3a32105f16abbbb73092c
SHA512 5536e678fdf83a939347265c0efded4a892e2cbbc9ec8d18c83de4f4d0467fad68eacb6abc4966eff5f275375dbfb3746d394fb4f2fbb34d7aada89aca6c8c20
SSDEEP 1536:MlI+vm/yJsMIMG7KfdJdztPT0/2Cc6CdLrTx45BCeXU5:89zw7iL
TLSH
T100631909BB8D4633D25E2BF90492275A2B39C2069147FFEB2D48B695BCDB3D10C3255B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gui.exe

Path C:\Program Files (x86)\CentraStage\Gui.exe
Size 2.0MB
SHA256 4f405ab4adfc0d397f7137ee9bbf7e9a215c311cf120cb78ea261e1abcbdeb21
MD5 a7905cb9a640d0ca2a1f39109f45c672
SHA1 66c617bbcdc572716f70320d0a153288705c34d8
SHA512 1180f961822248ed35640c1def4bbd2d613c0a9bb6d0216561200c7e8076edbd0e695d21f5d1b0808681ebff60d60e94b73eb667c22a0ef9564c1ef800bfbf8e
SSDEEP 24576:xd/HaJIyjEjEly/IuxIzbufR21COKqH7Re2EvP/z1w2LdB1PxQb3N/2:xpgEzIOfRPO835ZR5E
TLSH
T180A53A4173F44D1DE17F8B35A83354B487F6BE8696D5CB8E6998B2AE2CE97008D01393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gui.exe.config

Path C:\Program Files (x86)\CentraStage\Gui.exe.config
Size 5KB
SHA256 71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0
MD5 29d78bfd9a4c0d4f850250c25ca8112d
SHA1 ef2507e71626d4c8141d905dc00ff3fd5c163be0
SHA512 fd14b3eb42f04a5e66b570f005435589ecd5562a93293c1435494956220673d7b99867f3db3ff5842b3f5126f413126c66f9bc06b795b854301c0cf8bd2c1f67
SSDEEP 96:Tr7t7Kqe7t7nrrzGKULuvoFX4vdk6DAvJAvtv0cAvf4cv4vd3svjovuxAvmvPBAr:Tr7t7fe7t7nrXGKSuoSj
TLSH
T16EC1E80CB1C1AF9906736731EA3152D5EEB00663117A61E478ED31679F70CDA4BA33B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
Size 196KB
SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
MD5 c8164876b6f66616d68387443621510c
SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
TLSH
T16E14061967FC4A5BF6EA4BB8E47524A5C3F0B966362ED74E8D8050FF1C127A0C825363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Interop.MSTSCLib.dll

Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
Size 468KB
SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
MD5 e28c8111ea4cab3890fb559e977f5847
SHA1 cc19e6ceee81d2dcea7358cd0d9c53f442088dad
SHA512 af884009b08b864fa6bb215c37a9fe09ad7ceb3561aa6a53a47236c2b4102de097a039f8dc2843c3646bfa2b1eaa964296579f28c563008fdaf431b1db46812a
SSDEEP 12288:nvsVS7oxOnkN6TgJ2fclCLYh+XUdqjQ5vSUSR6ya/aIK1CWSzy8S5qaqHqQ6S7m7:nvsVS7oxOnkN6TgJ2fclCLYh+XUdqjQt
TLSH
T154A4192BBB4C2430CC9A037F91E707986FB155841667CF11560C5AF6AF9F28A8EC6376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Interop.ViewerX.dll

Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
Size 76KB
SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
MD5 fcbce484db6b9051b50381be4c70d4ad
SHA1 f752be7a7a0d9e7986855db6806b01c70350c058
SHA512 14ea0bf33c6635fa553646a654029c381f66c3a1a37507a10358a40370f43bdc253ffeb62795647a69436bb34a588d84d7bdaa169a58b0161867eb9d73c66488
SSDEEP 1536:wa1SD4xe/U9qbw5WXobIXpyTtMoEUJfIU9u3OoFKF2:x1SD4xe/U9qbw5WXobWpyTiiHu3OoFKQ
TLSH
T1AF738437B5A8D436D6AD823A47A7233423F0C5025DC1EF271A5CA5144F8AECA6F532B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Threading.Tasks.Extensions.Desktop.dll

Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
Size 46KB
SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
MD5 e548a93d16964e52868c47cef1c98f2e
SHA1 4b96b0aa48f6ac050a764c7d65f4129a9bb8cf21
SHA512 fd1377b5d2d792eccf2ab9a01529838f178126fd6748da8e27cbc908ea83813fb4de021aa88989186459fef1c11be76aaf8b29b2291203d5f34f98361acf77ab
SSDEEP 768:bsoKLggFUyETHj0Y5m64r+B6yP5wwWGZ8iJvHWrI:DKUgSyyD0Y5tVwwlZ8AWrI
TLSH
T1D4236D95C728957BCB463674EAE4D1825A34C7C28902DBAA3C99F0F5146B7F84B103BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Threading.Tasks.Extensions.dll

Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
Size 30KB
SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
MD5 6aa2393ff1fde1a61d0cf51730428f74
SHA1 3c847a95a6547aa49919789d7a0cb6ed76122849
SHA512 1af984ec56885cdea9a0e379d659b65196713571377e2db267259dbc1f8748f1a610b0183a8fea3730f0049c3468f632240475730563c6413cbc88cc76032d91
SSDEEP 384:5qL9uaxv+fg8SA4nrzrRzoGbSOW12nWH1q//0GftpBjHoH3HRN78xLsltr/wn:+MfmrRzZ+QD8idoH5r
TLSH
T14DE25BA1CFAC8143CD4B7D71D7A4D6C36D39C7E29C05DB66188CF0B41C973D99A20AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Threading.Tasks.dll

Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
Size 36KB
SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
MD5 d01819bfe03222dfa9e35a36555b6b6c
SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
TLSH
T1B5F27D89C3BC4117CEAB1E7196A4D5432E38EBC34812DB196588F2E51C937D19F3266E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.Services3.dll

Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
Size 864KB
SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
MD5 e42998e3bb92e6696a82ef796efac507
SHA1 8202e573a8abedaaa138b3cef6135ce09c0e87e6
SHA512 8dacb1fdd97e2ffb2c12c553c28739eb8a85807341d7decd665fd05724713c8b8937100739585517361f788840ffd0e9baeafc6fc810016b7f5b1c1ad2d9494b
SSDEEP 12288:2I/k6m+BkysR2NF7hlx6U4xhN9K+Da0QNgXOQMtsokoUoAQWG+GimYyY8ocZ:9kysRgFtlx6nY+iUG+CYyYc
TLSH
T1F1156C5537F8671BE16F8776E872402987F1F90F6662EB0E5CA182AC0C97FA08D41673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NLog.config

Path C:\Program Files (x86)\CentraStage\NLog.config
Size 2KB
SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
MD5 b9fcb1cee2d0e148ebfcb6e320df79e0
SHA1 271b4546996fb991d7d49b39d85a8f02e0c5cbdb
SHA512 76182b541c9718dcb9b2785507722f7c39fd1a530bcd5477214eff70b9aa566fc2902542a06664e3b7e08c3033d9c356dc93351c23fba1488bf295196e333546
TLSH
T11C41E1529A88CDF345B26654EE34742ACA81E3E7920814D6F0FEB2132F79D5349DB18F
MD5 SHA1 SHA512 TLSH

Submit Download

NLog.dll

Path C:\Program Files (x86)\CentraStage\NLog.dll
Size 678KB
SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
MD5 9bd9998fada60eb7e157148a5d681633
SHA1 0715f534b854ac2e3660dd073610e2c6426ef274
SHA512 d6507ded543d5f2ad1889698067b58d05dfcbec3613bfae92d655f5e032a03d7af4e79d2a2994366d14319f2611c719c61a5c50da489907608fd906e6c265864
SSDEEP 12288:0nq3M3ufU3inL3HzT1hUfYyHrZlrnYW3Y9AxspqZ+NUsQ:0nq3M3ufU3inL36ZDY0sxNUsQ
TLSH
T198E4281233EC4A2BD19F1735B4310926B6F9ED093A96E38F5545B1AD2C723866E103EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
Size 528KB
SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
MD5 8f6875148b45c300b95514cb40703c2e
SHA1 0015b8e21d84e0f6f174cf71b63651bad94582df
SHA512 e0670c00e0c5cb0e0e1c691f053a53de121e1771cffb17b2d08b8cc3f0498bdde3c6efe1419fd74103952a327c26bb6f29e5f817965873f8391ee8b8be80a6fb
SSDEEP 6144:H06bz+bF0GIPy8ydgpdK9Ea7YUKnK49wNgVaLgBFatK4/dc:HsbF+yvgGJYJnMWBAd
TLSH
T16DB4380023F8962BE6EF2735E138091547F5F92BE7B6D78F5E4094AA1CA37819D107A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Snmp.dll

Path C:\Program Files (x86)\CentraStage\Snmp.dll
Size 178KB
SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
MD5 a5a4cd5e052208055b3154e9afe2f463
SHA1 3be61fcc6003faab2f96577dc721618489dc367c
SHA512 b0ebff9dfa9308715d314d3d3f62bf329aad4222c95c450bc54dba793c5114cbcfa6b621e165462084664a0ecd85c16c0f98c28fd8d33866c30357ac3ac7d42b
SSDEEP 3072:0uDrtiTw0g6rzeqDfkphdsgfJgYy6eLkTR:Nhik0T/eOMbWDYy6eLkTR
TLSH
T19904F61DAF504163D2E91F3190B1931A57B6DE0BB643E3974B0435EABDB23F13C2269A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SnmpSharpNet.dll

Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
Size 108KB
SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
MD5 c9217b4fc057c99ef0b1c603de094a30
SHA1 8b6326767783e351c6bed00ea2aa46ce441048c0
SHA512 9f4a5efdd69fe6e72f80f7e1b4721308b8fb9b55e48997c31330e5b52fc75a27794b22cce3e16be01edc07616bbcb05a10fbcaa90459c9f99de6db8cd41c6b3f
SSDEEP 3072:baE/1gWxsZP9ecLJDyV3bkZ/qvrQsCfCRAKv2SXbvW5j+9eW1eP:bV/CrTJoks
TLSH
T199B33925B7FD4219E7FA5B78E4B4191507F1F8823537EB8E5D2160EE2923B818E21363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.dll

Path C:\Program Files (x86)\CentraStage\System.IO.dll
Size 20KB
SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
MD5 d552de7d39179b914db7cc2dbdd005c2
SHA1 044329c6c335224ba05a4e398a5fcb204f13ac36
SHA512 b82cbd6c4b3d378fba1793858c556ea1fdaa405905686ce219f192d16041e79aa063145c6d469aa7c15aa945d3ef344618fa0996d6611282a8718dd0de77d64d
SSDEEP 384:FJm/WFMrOhEZ0GftpBjMT6fMk+ILKHRN7uX6lFgJj:yaYbKi2zkmuXMw
TLSH
T1DA924CD68B7C8153EC935D7062A8DA833C3C97C35D11996E05AAF6E92CC33C4DB24A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
Size 21KB
SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
MD5 8e4e0ea396b5452bed54e6888cb07ca1
SHA1 1a7afcdd7f118b3ef8f1d9761fa71faeee16fd2c
SHA512 e160570f598d5fdd637725a70595a7ddc247c20aed66c031ff9816142231c8ea58c69fef7f5eb8e10120e5e5ad68ececb1b584054832464046209c9e04cc1aae
SSDEEP 384:r+4185WiR/B0GftpBj4T+ILKHRN7YSlVQP/:sLgiWmYws
TLSH
T19EA24B95CB7C8293ED835E70A6B8DAC33D3CE7C75C11912B1099F6952C833D59B24A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.dll

Path C:\Program Files (x86)\CentraStage\System.Threading.Tasks.dll
Size 34KB
SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
MD5 85f6f590b5c4b8c7253e9c403c9be607
SHA1 d5a9db942a50c8821bacd7f6030202c57ec4708b
SHA512 9c78cb444e28618d44e9deb23571fc7bbce268882c2803e0ccc0e84b3e6eab89c6af2aac0d81ef0d2c9fd1e9611cb35334ef3304fb16c5ba0481f6a7273c3660
SSDEEP 384:WL0xHprBefGMOrRQY+hoZhOZkcvr3Eql38WqATrOhEZ0GftpBj1x+ILKHRN7c6lE:NRBefGBkoWjvr0VabKirxmcM+
TLSH
T111F26C9987BC8117DD6B2DB0D6A4D5472D78E7C25C22DB1A24CDF2B82CC73C48721A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Transitions.dll

Path C:\Program Files (x86)\CentraStage\Transitions.dll
Size 17KB
SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
MD5 ad23b4cdfda55b7abe505087b246b1a3
SHA1 442fb06d6c8173429f8f4133478086ccaf4dc271
SHA512 2883f45d34da0afb792760ae7c6e0393b45749dcd4f532e4679a47b48feae3c6dac25279feda7934633305462cb22234bf7fc9a95b79372ec0ee79cf75cb89d9
SSDEEP 384:Ktt4bbA/FBBhZIqBCOfb9HKLQlk8Doy+l4:K/gK1qWnk8Doy+l4
TLSH
T17A721A0DA39C032BCD9F0B79E8F216010730AA946B33DF5D2D9A819A6D13B9545637BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vim25Service.XmlSerializers.dll

Path C:\Program Files (x86)\CentraStage\Vim25Service.XmlSerializers.dll
Size 8.5MB
SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
MD5 aa78ec5b23873e94e11f619b7566cc95
SHA1 3e4b0d084212dc096ae1b2b4194a11c4e9fa255c
SHA512 0c1e5adbd75341faad2664167b7ed13f38d62c210f8276eba6800a6d8c68ed290cc7c55ce296d857ca05ab22ce16e54bc5487403bec0455bb22786cf0756f2c0
SSDEEP 196608:mtuRrhgMpgu7PG6aA8SJ3/HrIyD5Ab1Ev9OnI:OE/HrIyNAxEv9+
TLSH
T1AE961C037ACC6E48E7BF27A610356FA59F3BB83345C6D6ED155A044924F4B70E980FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vim25Service.dll

Path C:\Program Files (x86)\CentraStage\Vim25Service.dll
Size 2.7MB
SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
MD5 ae2f45308384f5f2aaec76f079dca1af
SHA1 30e20b3f79f9164644b7ba2bc171cd60bcfb0690
SHA512 70612855e5dc8d2aa6c7d162f9ca8136f9d4747435547f63c16adf8a83fd5d9b4c88dc49c92d0d80b124073274c9f0870f4a7018a3a082872e39a46a908fc67e
SSDEEP 24576:CfvmVbrolKiE8p1l1OtoFwRnO6Ve3LxH0URSmzJqm1AoLwl8dQAD4dRcGEFDk4aR:Y1jp1lAfNIhNJtAoLwl8dzD4dSGEF
TLSH
T17FD5A749EFA8995BC49D477DEEF341220764E0887A06E35E3B51B4A41D3E3F1CE4B1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeifenLuo.WinFormsUI.Docking.dll

Path C:\Program Files (x86)\CentraStage\WeifenLuo.WinFormsUI.Docking.dll
Size 402KB
SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
MD5 93847672e8ab6a31d56a93b28daa130c
SHA1 3654b18fa3b2cbb90bf65ffd78b4449c04e7fd69
SHA512 9a5b77fc6dbb8ee7aa90f7b731e635437bc021f77dd373aa8e7e2c7bae37bb35b213d02881611c6fa7dac2566f3806663985c600f3008534dad1761bd9a81eb9
SSDEEP 3072:xjrP4sCRD9Fj2hmwUASqct0LmDpF6ffNvmFlHJkNHE6U/a0Oll:VrP4VRD9Fi9LmZZfS0O
TLSH
T18694B33185AE64A9D1BF0731EB1C267E55B1BC902351DA3BB821369F24B3760782C5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsAgent.dll

Path C:\Program Files (x86)\CentraStage\WindowsAgent.dll
Size 446KB
SHA256 32ec64ce65fb79886222d399973ce609297a9c8ba567cb9a0d0ceaf396e8dabb
MD5 751f468b023417de11a8aa6ca7cb0ef5
SHA1 d87f73e1a83ffacefbdeb8a30f9e4abdd91e7bb0
SHA512 3a0ac0a3029b9d43fa5ad2583eb1950d22690738ca6535eb950898379cd9e0179d2377b861ebbdc3aa563f3c79a22c80a5e93aac6ee37ad6b59b32fe36788c4e
SSDEEP 6144:qWObZ9leHh+59lDc5oWj+Fd5+sFnDyAdHr3BOX+nIIptzb0yp4gXjkbejn7s:q0U9I+Fvik3E+nIIpts+ku
TLSH
T12DA4F64023F94958F1BF6B7869B145254777F906AC79D65E0A8CA89E0FB3B41CC20B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Program Files (x86)\CentraStage\log.txt
Size 5KB
SHA256 2eded9d420b1efebcf7a641d304b319e06e1e9a44d346c0411a7607e446a0ce3
MD5 9f6f9494e7ada58f99dc999d2903a641
SHA1 7f119cf66f2d3c5632df3145740309ba5fa35b97
SHA512 40a17fdeea8c48c4ea78bb2f2fc97101accdb73138db85812be40110703d0c7884d4d83f70d7c7c8d3b032691c0b22bda98588cce9a0cbb455e6bf3b16096850
SSDEEP 96:vaQT/Vn+bAVJNINwVqHEVHFAVF/RV2NnNwVmK8lYLYAVGt/tEVlqAVoDAVgbAVUJ:vaQTdn+bGJNIN2qHaHFGF/z2NnN2mK8V
TLSH
T126B1AF3025B27D954C579F0568047B8232EBAB9F9B644AC967213F9F9E0485B83370BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scvncctrl.dll

Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
Size 1.8MB
SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
MD5 9defb2682db3afbc640ac3fdf4045154
SHA1 3996fe866d6bd39878ea6b498e439589020c1ed8
SHA512 96cd9d69d2cafa31bb3ae64bab26473c70eb60fe868c36d6b5f03cc512b500420c8a4ac2b63f30997aee397ec7326bd56d5dc020d574c52db57120aa52c735d2
SSDEEP 49152:fimimklizfY90IsmeRlUcjWyw1AVOsForTRFoaxCf:Kx6Y9K/RlFbw1AVOsFWm
TLSH
T1DB85BF02F7818472E1DE0130517AABBA593DEE38172985D7A3D439BD9D702D26B3E387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.json

Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
Size 190B
SHA256 f5ac187e41638e6319a4369d21a0eece7ac12a546403ae97958b2333dd8fc847
MD5 0746aafb8773655c178b9d019a16a2b6
SHA1 458a7b5d94db4c920662edc680d39ab0cdad8c77
SHA512 8f6143ccc818134ff7dd7ea151e448618d28fe79c7e2d03c2d648851507d9755cde6f48e6607924d8176596cf99b5d464c84d9d49533ad44ef023fe566ef7f37
TLSH
T1ABC08031DD54117F7535519C6D72D3D216551F4C11768D9775F710055907A127122FC3
MD5 SHA1 SHA512 TLSH

Submit Download

windows_agentrto.ico

Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
Size 26KB
SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
MD5 cd9862ffc37089c4a48487332608003e
SHA1 07a0f12bd381359aefbdc0c9f0a23ea3affd5501
SHA512 a1abb6e1f950790c040c124ba37a522a6d2b01c5278df9cc6ea97d78546d08fb7f8d52986746d2ba3c83e306cafae934bcbe0b01961d1af77335e995e79f20d1
SSDEEP 768:pCtbHbSN4QeEwfRC8eUqqqFqYLHEuAkLGo:poGNFsqqqFqaGo
TLSH
T124C219D17F5499AAC7B4EFB8E317CDE07682D104046FC1C4756DEEF6247E8212989E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_alertmodeoffline.ico

Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
Size 23KB
SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
MD5 0e4cbf0c007ce5d60304772c8f503090
SHA1 cbd677f00967bee819c0d77021a7b4028b7e51e0
SHA512 44716daf9b404f9d9c9a5f259794a859d745e0da01d48cad4b893f3d9f55f8a59a36a6ebb091b46a588e23cd010b6cca2fc0d8e676b1576b2b8474d6d95aaa93
SSDEEP 384:l8fk/g4FLHOXmbOCWIL6tbND/QkrrrrrNrrrrrSZsBUEDqdsrrSrQ3LjdukG3dzG:CM/B1H+mbdgBD4nlEDBjdutf7i
TLSH
T115B2F84262F0093ACCD8C8366182D5F09DFEAEC757592D63AA03F16A2B9470D3697F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_alertmodeonline.ico

Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
Size 27KB
SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
MD5 a1614d3cd16e59ce53247b2657a6212c
SHA1 2d715ab6693cebb51f2c387859245a9698c0b6a8
SHA512 8ba7ea55a58649496fc8c678caaa2776ff44cd58a99088ff30ddea4be072e7a2eed8a0085eb044224460464c9ddc89f71e36df4480cbfa8eaa6cafb56024c900
SSDEEP 384:Nn16FLjZXTy1L7Vh8If2ec8SjVrrrrrNrrrrrF1YsissigS8rr5rrfcDuN+Okudo:NwtI1VOIf2QaY5igS1Du2urW
TLSH
T1CBC2F7C3BDF059A6E7F4D939E357C4F135829C95021AC5D1B96DFAFA22206013E86F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_offline.ico

Path C:\ProgramData\CentraStage\Brand\windows_offline.ico
Size 20KB
SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
MD5 4f1bc31de060a6f442e17e8beaa463aa
SHA1 9e49e30d29d01025262645016f4dbc401bbc1270
SHA512 b82cc65ddeb0b1ac64fd3ade306ff803ce019a57161a53c5fbc1fe86098727afddf6e1c29903ec74a488f566e5a20212fbe45fba34327ce7608b4a145c19c3d5
SSDEEP 192:bOyMj9T0U3BmKAu3QlY7gQ+C9M/dqtDPscbCfLy+E7GJzwKti0m7N:qj9T0GmKhREC9qy04Cf2+PFtpm7N
TLSH
T1FB92F7656770A01DCDC0167809A296D0DEFA9F0F8B282E637792D50E2F9221E7953F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_ondemandmode.ico

Path C:\ProgramData\CentraStage\Brand\windows_ondemandmode.ico
Size 25KB
SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
MD5 77d6a95b5d51fae0e42e22e13bb0da96
SHA1 0827b38137de640c16facf2197a20ed2a4f43603
SHA512 76241cec250d4327d122995ccaff6c8b14dafc4bcacaa840ffc578dc85a9768b00707bf46fef00c9caf7a0ff2ea60a350ae1966f087e9e378ea068b2a9150b70
SSDEEP 768:2JUjzsB0M1B4cx8J0m5R699FYE+R0LAk64:CUjApk4
TLSH
T16BB2C7D17EE198F5EA79B93CC313C9F1B5A24150000ACEC5AABEBEB529745043F0DE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_privacymode.ico

Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
Size 26KB
SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
MD5 eaa1bc541ffb306eef6cf6faac22b6dd
SHA1 3e292bce03d0d8744278403bf92dad4ea3b30ac0
SHA512 ecbb073d8b5c0e44e33c5fbb7d436a14869014144536f3e86de539decdd67c8409cc07f47458de746e2f42fc81be00a31bcfe60d14ddd2149ec42718e9715c94
SSDEEP 768:Xl2aPw8AXQ1IOgHG8c2yMSaz6trVIvPxKcLET:Xl2+w8AA18/c7r9cYT
TLSH
T13DC2F6D2BDA0CAE9FE78BA75E353CDE1B78310A40059C4D4B9DD3BB53574012AE08DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_stopped.ico

Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
Size 21KB
SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
MD5 420547a9246bcb1000bb646c7e8dd396
SHA1 3907dbb594ac87511da89679bcf2ee6a743e6c57
SHA512 4ce1a1ddcdd1df43c38f3020c0118a280eb494365ceafce1f8bd914ddd53a47a466bc7c3b48f0bb64b7fdc8a2d1580e02eaaec2682f2747586c0156e712ba40e
SSDEEP 384:enuXnpnmuVQbX2QbT8SIn92yTedpTDW75:eknlbmbX2QboSInQiypDW75
TLSH
T159A2F8284B38056BCFC1EA7544E7DEE84FFAD613170FAE97B956C4841A2D61B3420F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C56C4404C4DEF0DC88E5FCD9F09CB2F1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Size 1KB
SHA256 46011ede1c147eb2bc731a539b7c047b7ee93e48b9d3c3ba710ce132bbdfac6b
MD5 d91299e84355cd8d5a86795a0118b6e9
SHA1 7b0f360b775f76c94a12ca48445aa2d2a875701c
SHA512 6d11d03f2df2d931fac9f47ceda70d81d51a9116c1ef362d67b7874f91bf20915006f7af8ecebaea59d2dc144536b25ea091cc33c04c9a3808eefdc69c90e816
TLSH
T1B631DAA348A04C28CD5B8F507AD0D1397E7168C979D0C0D8F16F95AAE3543863BE82FE
MD5 SHA1 SHA512 TLSH

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Size 1KB
SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
MD5 78f2fcaa601f2fb4ebc937ba532e7549
SHA1 ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA512 bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
TLSH
T14421C64312603C088B17DCFFB915C9BA65BA7D96AC22C870424ED9D017B97CF54AE06C
MD5 SHA1 SHA512 TLSH

Submit Download

C56C4404C4DEF0DC88E5FCD9F09CB2F1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
Size 308B
SHA256 e31e3302c16839e5069bc725ed1177a3870be331abf14453e3edce0649f799da
MD5 d91b4d0e3a09dab04d1c33bd256cc513
SHA1 52785607938ad456be36618eabdc94729be3ae48
SHA512 c3570292ce92fbc9eae379c3645e43c93d161c429b9f486e2dcab0402673d54fd32682fadaa1e16fc7222e79c91b4fd717d49340542ee0bb8c631b5af00ac6fb
TLSH
T1EBE0A708BAE0161FF3D38A7D42F201426A20F9566406CE0D03E0165D4831F402C21E29
MD5 SHA1 SHA512 TLSH

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Size 254B
SHA256 36a0d85bfce124405687d25b38b1e103abe1b1deeb2d91b0c862956ddaa7308e
MD5 43e8483a8608481ace0635254b1c7bbd
SHA1 d4838f24b8b9af0f98f1386b6fe1ecced780a7fa
SHA512 b77462265fa27b512580da1ec5d5fea9992d77051c572e277c2ba124020ed8c28a5da227e907f6201c5b004fe199d19d1a146e881743200b82fe9f167263c268
TLSH
T133D01220A7F58753F3A5193959754141A931BA949442CE0942F1108D5431F405D6191E
MD5 SHA1 SHA512 TLSH

Submit Download

mxafrhaj.newcfg

Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\mxafrhaj.newcfg
Size 1KB
SHA256 bb9947061311f50fd881686c37f4317df5cdf3bf25449ac14516cd8399717e4d
MD5 7f2aebdafe4a62edbe5db550e791e982
SHA1 95d048928088154b3e375b482ff3f686a7ff4f87
SHA512 3693bdf30c1c1d020d2afeb7ee2eb3ea646c07e63e6f446e5243084d2f0a805ca87bd67d4ef87605343fc92f3d37e89ecafb683f56a3c39cb097278e8ebcd04b
TLSH
T18611DC88A6C01B6BD1A2CA36F5A5BB80DEE0350391E760E076BC61732F348590AD3671
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\user.config
Size 344B
SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
MD5 92eae47c5f430471f99f86e4978a88a1
SHA1 9bdf5b9ecd78cf7a5a3f4b835023d019494d780c
SHA512 d64c4479e766f8f65355c9bde58d856e0eb56febce231ae31e79a66048a21f8ebe3fa6f0179bf265ac4856d24af6b2d22493efc3155efc6044655e9754d0ac27
TLSH
T1C4E01209A4C05E6B91B18E32D6684F85EEE0299390276170B97D12732B204840BC37B1
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.11433.11433\user.config
Size 495B
SHA256 548a5e1409eee10741c8ee49f11ba6b19cb402a60e2eea8d585b3a715874249f
MD5 df8e1015de08f953c5e2ba03721ff13e
SHA1 c2ffd6f79d592fa9d8faa7461d6f7c928cd43320
SHA512 28f24594a40896132616e3fbe191c758f058c57ea4094ca3c8000a49229d2688f5eff78bcb4851e0535776eb4c9052593ad2307c776962486a414f777638c0ea
TLSH
T124F0650CA5C05F6B81B64A31D6644F85EEE06553503665B0B9BD21733F308940AD3770
MD5 SHA1 SHA512 TLSH

Submit Download

SimpleFC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\SimpleFC.dll
Size 175KB
SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
SHA1 99778940e059238ca23a513e717d4db2cf34e606
SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
TLSH
T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\SimpleSC.dll
Size 61KB
SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
MD5 d63975ce28f801f236c4aca5af726961
SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
TLSH
T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

Submit Download

nsSCM.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\nsSCM.dll
Size 5KB
SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
MD5 62efa7b730eb0523a026ea4325403b77
SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
TLSH
T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa391D.tmp\nsisXML.dll
Size 11KB
SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
MD5 13deb9a0f4e4286df01abc85e1895e09
SHA1 3174853b32407fd85220de844b390a18a8a76c97
SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
TLSH
T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2zxumys4.newcfg

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\2zxumys4.newcfg
Size 725B
SHA256 6c010ac9ec67b3c5e21b07cd3bca44502a9ee706003d46cbe30aafa59e3f9f4b
MD5 ce0af740e22c3aa267c22e5c9487750e
SHA1 05ec4f03932bd74366a4710ef916729ebf853215
SHA512 b50dcbe390f45df1414df353a6984e4f652006d478869dc6aaff5113235c6ec1cadd70be19d4527f992c8ed4294d43081fc200ed80a2c38848c35cc3d7bddc8d
TLSH
T14201900DB1C0DF6B4172AA35E7745A81FEE019635166A4F078FD21A32FB5C990AE37B0
MD5 SHA1 SHA512 TLSH

Submit Download

5tys1bh1.newcfg

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\5tys1bh1.newcfg
Size 438B
SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
MD5 af7e9272ff1e4c4d9f08ad1e6a0e8265
SHA1 9f9b3f0618acdda6150d13cfb59441502591c362
SHA512 302000506e68903164ae91dda56353dd51e82cd503dbd5e2ca33154a782d227d360b37d1fa2d53431b01a58c0900e583fd674252e7a06ac743ff41604da3f9ea
TLSH
T14EF04F0DA0C09F2B81729E36E3B44B80FEE01553506754B0B8BD21B31FB18890AD37B0
MD5 SHA1 SHA512 TLSH

Submit Download

f1mj1uap.newcfg

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\f1mj1uap.newcfg
Size 313B
SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
MD5 21eb0aaae4bff3f7552657d58d9d948c
SHA1 473b9163997ed445bf6111f0b24def63403a40d4
SHA512 cc202704b17f17fdf99095e90d5166e8f7a424782cf49301b1477e01899a8666a67a8bbf09046a6907b7e08001c72638ec8705511c77c805741bb44c1021b57e
TLSH
T152E01709A0C05F2B81628D26E3A84F00FFA02A8790674474B47D61B31FB58840AC33A0
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
Size 992B
SHA256 06d64d6367388203972cbd28d91136457ace2a37f5b6cd2c95aaea667173d36e
MD5 3f9a72a49cb8f51f129a5f67f646da0b
SHA1 352624c4640070f820128c401af7b0f8fb3323e7
SHA512 e5d9a7cd5ddd000520980cae32ed7e429968cbb23e16885e30c9a9a41e794522ca5ce2e6634fffe609b25a8341a5da8b5dbc7b0cba61126db2f11028a4d89f97
TLSH
T11411750DB1C0DF6A4172AA35E7745A81FDE01923116660F078FD21731F74C9949E37B5
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.11433.11433\user.config
Size 313B
SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
MD5 e62ebb9474f9d62ee59bb69a9a4b7f6c
SHA1 b76cfef47296b300dd595caa362185f45f3c3ede
SHA512 607bb4704db0dd65f444c1e0e674f7a503382eff69bd82a37fa205b7d59057aea5f16975c516706efd8478fb3d1e8e8223c03b235aaa57672ff7f7e35c3bcd13
TLSH
T164E01709A0C05F2B81668D26E3A84B04FFE02687906744B4B4BD61B31FB58840BC33A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-170-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2484-54-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2484-78-0x0000000002C80000-0x0000000002CB0000-memory.dmp

Download

memory/2484-116-0x0000000002C80000-0x0000000002C93000-memory.dmp

Download

memory/2484-0-0x0000000000438000-0x0000000000439000-memory.dmp

Download

memory/2568-304-0x00000000074F0000-0x0000000007B08000-memory.dmp

Download

memory/2568-146-0x0000000000A50000-0x0000000000C60000-memory.dmp

Download

memory/2568-151-0x0000000005540000-0x00000000055F0000-memory.dmp

Download

memory/2568-152-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/2692-474-0x0000000009AE0000-0x000000000A57E000-memory.dmp

Download

memory/2692-337-0x0000000006850000-0x00000000068A6000-memory.dmp

Download

memory/2692-499-0x0000000009520000-0x000000000952A000-memory.dmp

Download

memory/2692-484-0x0000000009530000-0x0000000009580000-memory.dmp

Download

memory/2692-476-0x0000000009130000-0x00000000091FE000-memory.dmp

Download

memory/2692-290-0x0000000006130000-0x0000000006487000-memory.dmp

Download

memory/2692-356-0x0000000006AA0000-0x0000000006AAA000-memory.dmp

Download

memory/2692-334-0x00000000066B0000-0x0000000006742000-memory.dmp

Download

memory/2692-333-0x0000000007680000-0x0000000007C26000-memory.dmp

Download

memory/2692-335-0x00000000070D0000-0x000000000732A000-memory.dmp

Download

memory/2692-336-0x00000000067D0000-0x0000000006846000-memory.dmp

Download

memory/4864-236-0x0000000001250000-0x0000000001262000-memory.dmp

Download

memory/4864-140-0x000000001A010000-0x000000001A26A000-memory.dmp

Download

memory/4864-196-0x0000000019F60000-0x0000000019FD6000-memory.dmp

Download

memory/4864-186-0x0000000019C50000-0x0000000019C82000-memory.dmp

Download

memory/4864-222-0x000000001B510000-0x000000001B5EC000-memory.dmp

Download

memory/4864-173-0x000000001BCD0000-0x000000001C76E000-memory.dmp

Download

memory/4864-226-0x0000000019EB0000-0x0000000019F00000-memory.dmp

Download

memory/4864-243-0x000000001B460000-0x000000001B478000-memory.dmp

Download

memory/4864-211-0x000000001B6F0000-0x000000001B9A2000-memory.dmp

Download

memory/4864-235-0x0000000019CD0000-0x0000000019CFA000-memory.dmp

Download

memory/4864-141-0x0000000019F50000-0x0000000019F60000-memory.dmp

Download

memory/4864-233-0x000000001BAC0000-0x000000001BBCA000-memory.dmp

Download

memory/4864-138-0x0000000019D00000-0x0000000019DB0000-memory.dmp

Download

memory/4864-168-0x0000000001210000-0x000000000121A000-memory.dmp

Download

memory/4864-229-0x000000001B5F0000-0x000000001B6A2000-memory.dmp

Download

memory/4864-276-0x000000001B4C0000-0x000000001B4F4000-memory.dmp

Download

memory/4864-479-0x000000001C8C0000-0x000000001C8CA000-memory.dmp

Download

memory/4864-480-0x000000001D120000-0x000000001D1AA000-memory.dmp

Download

memory/4864-478-0x000000001C8B0000-0x000000001C8BC000-memory.dmp

Download

memory/4864-241-0x000000001C8D0000-0x000000001CA28000-memory.dmp

Download

memory/4864-136-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4864-242-0x000000001B430000-0x000000001B452000-memory.dmp

Download

memory/4864-500-0x000000001D7E0000-0x000000001DD08000-memory.dmp

Download

memory/4864-514-0x000000001CFC0000-0x000000001CFE2000-memory.dmp

Download

memory/4864-234-0x0000000019F00000-0x0000000019F3A000-memory.dmp

Download

memory/4864-563-0x0000000019F50000-0x0000000019F60000-memory.dmp

Download

memory/4864-232-0x0000000019C90000-0x0000000019CCC000-memory.dmp

Download