Overview

overview

9

Static

static

8

Disburseme...26.exe

windows10-2004-x64

9

Disburseme...26.exe

windows11-ltsc_2024-x64

9

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-ltsc_2024-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-ltsc_2024-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-ltsc_2024-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-ltsc_2024-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-ltsc_2024-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-ltsc_2024-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-ltsc_2024-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-ltsc_2024-x64

1

Resubmissions

02/11/2026, 19:05

261102-xrgf9agb529

02/11/2026, 18:17

261102-wxfapsfh569

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Disbursement_DocRev__2026.exe
  • Size 18.3MB
  • Sample261102-wxfapsfh56
  • SHA256 0efbb1f02b921410f6f9c334f2d24f63a39775bd112880abc1af91fa74bebd63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
backdoordefense_evasiondiscoverypersistenceprivilege_escalationratspywaretrojan

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 11 IoCs
    defense_evasion
  • DattoRMM remote administration tool 1 IoCs

    DattoRMM is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Disbursement_DocRev__2026.exe
    "C:\Users\Admin\AppData\Local\Temp\Disbursement_DocRev__2026.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5852
  • C:\Program Files (x86)\CentraStage\CagService.exe
    "C:\Program Files (x86)\CentraStage\CagService.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
      2⤵
        PID:5640
        • C:\Windows\SysWOW64\regsvr32.exe
          /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5392
      • C:\ProgramData\CentraStage\Temp\9b5951a2-53aa-4868-8317-77134d39c0b4\AEMAgent.exe
        "C:\ProgramData\CentraStage\Temp\9b5951a2-53aa-4868-8317-77134d39c0b4\AEMAgent.exe" --version
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3172
      • C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
        "C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"
        2⤵
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3688
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="AEMAgent"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4744
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5784
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3376
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
          3⤵
          • Modifies Windows Firewall
          • Drops file in Windows directory
          • Event Triggered Execution: Netsh Helper DLL
          • Modifies data under HKEY_USERS
          PID:5652
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • Modifies data under HKEY_USERS
          PID:1808
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Aria"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5304
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2560
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 15.1.4.13205"
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5096
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 15.1.4.13205" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4364
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 15.1.4.13205" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.exe" enable=yes
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2124
        • C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.exe
          "C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.exe" --web-remote-daemon aemwr-6af934e6-d484-43d7-b3cb-dd78fb241216
          3⤵
          • Looks for VirtualBox Guest Additions in registry
          • Boot or Logon Autostart Execution: Active Setup
          • Looks for VMWare Tools registry key
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2532
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • Modifies data under HKEY_USERS
          PID:5276
    • C:\Program Files (x86)\CentraStage\Gui.exe
      "C:\Program Files (x86)\CentraStage\Gui.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1608

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          4
          T1112

          Subvert Trust Controls

          2
          T1553

          Install Root Certificate

          1
          T1553.004

          SIP and Trust Provider Hijacking

          1
          T1553.003

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Discovery

          Query Registry

          4
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AxInterop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dll
          • Size 240KB
          • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AxInterop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dll
          • Size 40KB
          • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe
          • Path C:\Program Files (x86)\CentraStage\CagService.exe
          • Size 19KB
          • SHA256 5aebcbd72f6a969dd2b3c3a79457736a5b21742918611382ace2c16d8d79936d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CagService.exe.config
          • Path C:\Program Files (x86)\CentraStage\CagService.exe.config
          • Size 3KB
          • SHA256 37b37c29c02cfa0e4d0d54f05abf9c994c8b264ecf530ff62565b934dd912c82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Common.dll
          • Path C:\Program Files (x86)\CentraStage\Common.dll
          • Size 16KB
          • SHA256 9fccb4772a94e5dfd00a11ff7e7691c902efaecd2cb42789fd9a0da5fb999260
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.XmlSerializers.dll
          • Path C:\Program Files (x86)\CentraStage\Core.XmlSerializers.dll
          • Size 10.6MB
          • SHA256 0ccdac090d53788db358e8ef5c7d6957150bd79f5de45ef1aba319c037e68845
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Core.dll
          • Path C:\Program Files (x86)\CentraStage\Core.dll
          • Size 2.3MB
          • SHA256 b5cc9ff42d0560cb4fa7e851a56b949e337400a735a038c94260092bd4a1e546
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Core.dll
          • Path C:\Program Files (x86)\CentraStage\FSharp.Core.dll
          • Size 1.3MB
          • SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FsLexYacc.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dll
          • Size 69KB
          • SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe
          • Path C:\Program Files (x86)\CentraStage\Gui.exe
          • Size 2.1MB
          • SHA256 77d01fee91e217d28af0d6ae2b34a7d7aad8f1556a96555d8dd57f4d0a36e12b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Gui.exe.config
          • Path C:\Program Files (x86)\CentraStage\Gui.exe.config
          • Size 5KB
          • SHA256 fd789235cf85da8aeb6294cfd5a8c07438909321e50f8a5f81821d0ca48626b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ICSharpCode.SharpZipLib.dll
          • Path C:\Program Files (x86)\CentraStage\ICSharpCode.SharpZipLib.dll
          • Size 196KB
          • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.MSTSCLib.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.MSTSCLib.dll
          • Size 468KB
          • SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Interop.ViewerX.dll
          • Path C:\Program Files (x86)\CentraStage\Interop.ViewerX.dll
          • Size 76KB
          • SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dll
          • Size 46KB
          • SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.Extensions.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.dll
          • Size 30KB
          • SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Threading.Tasks.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.dll
          • Size 36KB
          • SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Web.Services3.dll
          • Path C:\Program Files (x86)\CentraStage\Microsoft.Web.Services3.dll
          • Size 864KB
          • SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NLog.config
          • Path C:\Program Files (x86)\CentraStage\NLog.config
          • Size 2KB
          • SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NLog.dll
          • Path C:\Program Files (x86)\CentraStage\NLog.dll
          • Size 678KB
          • SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\CentraStage\Newtonsoft.Json.dll
          • Size 528KB
          • SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Snmp.dll
          • Path C:\Program Files (x86)\CentraStage\Snmp.dll
          • Size 178KB
          • SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SnmpSharpNet.dll
          • Path C:\Program Files (x86)\CentraStage\SnmpSharpNet.dll
          • Size 108KB
          • SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.IO.dll
          • Path C:\Program Files (x86)\CentraStage\System.IO.dll
          • Size 20KB
          • SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files (x86)\CentraStage\System.Runtime.dll
          • Size 21KB
          • SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsAgent.dll
          • Path C:\Program Files (x86)\CentraStage\WindowsAgent.dll
          • Size 370KB
          • SHA256 aabc7bf72b46e8b1aafeb2acb38b8811a3ad22f2cccbebdc766dd2986a4bee3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 528B
          • SHA256 05a8ade701f0e7668ee39455c3850d70d14c382abeaf08fac714c8535b5cfaa3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 666B
          • SHA256 bd25acce5af49ef8293bd2ee6280143708c44743dd21f59e86cd49cec423c711
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Program Files (x86)\CentraStage\log.txt
          • Size 5KB
          • SHA256 a473fa72175d99e46349a7bf2abdb61e0e16b5e84d5a8c87947fec64f4bad4d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scvncctrl.dll
          • Path C:\Program Files (x86)\CentraStage\scvncctrl.dll
          • Size 1.8MB
          • SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mscordaccore_amd64_amd64_10.0.826.23019.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\.net.runtime\10.0.8\shared\Microsoft.NETCore.App\10.0.8\mscordaccore_amd64_amd64_10.0.826.23019.dll
          • Size 1.3MB
          • SHA256 20ec1a3a31e5287c4de606aad2eae7d0ccbe5c2e1d17db44f543b556a3166b8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet-runtime-10.0.12-win-x64.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\.net.runtime\dotnet-runtime-10.0.12-win-x64.zip
          • Size 35.2MB
          • SHA256 da3947e6acbb5228e4e987c7585aa40ce2d7000856e3da0804e6ee3771e806dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet-runtime-10.0.8-win-x64.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\.net.runtime\dotnet-runtime-10.0.8-win-x64.zip
          • Size 35.1MB
          • SHA256 21430a88427ee89623dd15e302435575bb734e19385b1777d690e4ab26348c08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgent.dll.config
          • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgent.dll.config
          • Size 35KB
          • SHA256 78f2cbdbc8f980c52a0ba293ff31c59e849f100d8ea56e09494b27ac0307ef54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgent.pdb
          • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgent.pdb
          • Size 644KB
          • SHA256 597e9aa78e2d05624774ac84dca7fa3aca0965532a007af223f4e4ccf863fc07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgentDeploy.netcore-win-x64.15.1.1.11110.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\AEMAgentDeploy.netcore-win-x64.15.1.1.11110.zip
          • Size 11.1MB
          • SHA256 387e7197749acc2db69da0f9764fcb0f7072b689dc5e69761ffa0506a956665e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BouncyCastle.Crypto.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\BouncyCastle.Crypto.dll
          • Size 3.2MB
          • SHA256 f42b8609854d80d7f81f276340504aa5e82bbe4d73d05080fef1fcca2444b4d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Cronos.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Cronos.dll
          • Size 63KB
          • SHA256 e0ad7c799904f1b663ab090b32665e0e90ede27699937588900845383064ba03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          webremote.log
          • Path C:\ProgramData\CentraStage\AEMAgent\DataLog\webremote.log
          • Size 6KB
          • SHA256 b2dae259118b5cb6cbe34ca44fdddfb84c68a236f556aede35093b62ab40181d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DnsClient.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\DnsClient.dll
          • Size 153KB
          • SHA256 fcf2d07f01bb34f6e8ea61da6d281d1979b5d3c1485bcc5b2b350ec8c59cc2f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FParsec.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FParsec.dll
          • Size 235KB
          • SHA256 147154cd8e33699c1458cd7653b78d6c93c2ea272e9aeb3f838af95af2a82b23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FParsecCS.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FParsecCS.dll
          • Size 102KB
          • SHA256 1822de41fcf78bf92de841f03e9a5c78db7fb1eb19cf699f78e06f064e0d4013
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Control.AsyncSeq.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Control.AsyncSeq.dll
          • Size 503KB
          • SHA256 77292dc5587d775ac838e5b95005eb0a8ab4a8d2b82ab7c6e3523f3618091732
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Control.Reactive.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Control.Reactive.dll
          • Size 364KB
          • SHA256 c4810ab6437065e8e32db9f9ccefe848b0bfd647d09c54b51be3c7e1cf3880fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Csv.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Csv.Core.dll
          • Size 85KB
          • SHA256 45e1c0d6dfb60b42e4c5faf0d8c654772bb0be1a37a893edd581e41a4c5c1de8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Html.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Html.Core.dll
          • Size 395KB
          • SHA256 850943dc293173635492551f3771c894872b1174698fec251bb92891aa05f3a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Http.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Http.dll
          • Size 161KB
          • SHA256 729fac2d4d31797310eebdcd3b93114479c304e590884b8fbcedde4b779fd475
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Json.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Json.Core.dll
          • Size 132KB
          • SHA256 78a1112b5469c482cb861506970c5864dd0cbd1ca90b3fc9dfce07bd66e3bc67
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Runtime.Utilities.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Runtime.Utilities.dll
          • Size 160KB
          • SHA256 b1b8699e42aae8bba12755feca388dd6f46e925fb9fcffdc333ffd6198e577ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.WorldBank.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.WorldBank.Core.dll
          • Size 72KB
          • SHA256 ca08c5d0978d372a50c3b5b04425e7aed15e3d649babb1fdd801c6491421d3ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.Xml.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.Xml.Core.dll
          • Size 82KB
          • SHA256 6aa81fbdba6592b290e0de5139340cceb568a8ca74f94dd58e795c76295b5088
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FSharp.Data.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FSharp.Data.dll
          • Size 15KB
          • SHA256 0cbe46e282bfd39cd0a9b06594c00e6ddbc71394217cb5cf38a5e108cb760098
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Fable.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Fable.Core.dll
          • Size 212KB
          • SHA256 dd19497ffc1ed0d657ef8a92be84575e82a51e125ec2db03605eeaa8faef271e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FsToolkit.ErrorHandling.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\FsToolkit.ErrorHandling.dll
          • Size 1.7MB
          • SHA256 27f2eee006ce7ed9bfdb051c9dc61c9a7f7dcf9bb6c125a4e2a136215128ddc3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ICSharpCode.SharpZipLib.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\ICSharpCode.SharpZipLib.dll
          • Size 252KB
          • SHA256 32ea2d0ce3512e74f1c7ad82591fe67e6b8939d76a8a4ff9c93ead030131e71c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Licenses.txt
          • Path C:\ProgramData\CentraStage\AEMAgent\Licenses.txt
          • Size 3KB
          • SHA256 6f7c551ffd4b7f1f81a6d431526e798cefc86f97f5152aded0f4aba067f3e3f2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft.Bcl.AsyncInterfaces.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Microsoft.Bcl.AsyncInterfaces.dll
          • Size 20KB
          • SHA256 2212afef01205112ca9ad2548f9cb6722d3ccc1d0fe7abbf1c28d48f6c1d3355
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.ObjectPool.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Microsoft.Extensions.ObjectPool.dll
          • Size 22KB
          • SHA256 f6a97b0445eba6d4d1f05321377eac68fd925b819125c8fe9231fca3a48463ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Win32.SystemEvents.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Microsoft.Win32.SystemEvents.dll
          • Size 79KB
          • SHA256 eaad2473359e4decc516a8744086cec566fbcf87674a6eee39ebbe37842e6313
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mono.Unix.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Mono.Unix.dll
          • Size 185KB
          • SHA256 99bafdcab6e98708f76d6359c7b855994680385de3d6d2f0eb86d891f13074ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetworkNode.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\NetworkNode.Core.dll
          • Size 649KB
          • SHA256 771f63396988a9ec3af5a05627ccf9537eba23963d134cb5069dc35501f34af9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetworkNode.Core.pdb
          • Path C:\ProgramData\CentraStage\AEMAgent\NetworkNode.Core.pdb
          • Size 127KB
          • SHA256 2a0235cd17a2fee0b7643344629b43d20b038e995d3bd905463b6a3defcb5538
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Newtonsoft.Json.dll
          • Size 706KB
          • SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Polly.Contrib.WaitAndRetry.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Polly.Contrib.WaitAndRetry.dll
          • Size 14KB
          • SHA256 3fb02f7cb4c122998cfca8931ea8477396cfe664107bbd7eb794438a4bd4a11c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Polly.Core.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Polly.Core.dll
          • Size 217KB
          • SHA256 802ffe5c74c26cf6bdd0f0ecacc36965807a267765f61b63eea8605da15fe0e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Polly.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Polly.dll
          • Size 281KB
          • SHA256 6b1ce3233d82c4e2a6141054b25f0bc63ad6b9b493c4bec2c6fe47fab3924584
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RMM.WebRemote.deps.netcore-win-x64.15.1.4.13205.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.deps.netcore-win-x64.15.1.4.13205.zip
          • Size 44.2MB
          • SHA256 6f6c15f1234422fd127d582217428c786ec01a2a9f9b72d912995d2a88208865
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RMM.WebRemote.exe
          • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.exe
          • Size 161KB
          • SHA256 4dfdeb502a1c862526ad8649a6f76973c82a7a6fe9bbf9b196ae29583823eacb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RMM.WebRemote.netcore-win-x64.15.1.4.13205.zip
          • Path C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\15.1.4.13205\RMM.WebRemote.netcore-win-x64.15.1.4.13205.zip
          • Size 1.7MB
          • SHA256 1cc54ebb86fd12757dff3bdcd82391ba90d5b8be2e9a3bc9016cad2575e29bbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RWDetectCore.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\RWDetectCore.dll
          • Size 307KB
          • SHA256 2bc7728fdeb132c8db6d772ce512ed51a9044ac01cfcbe0fbbd4de40eb7faf78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 264B
          • SHA256 002c3789558a2d3e01c3b857a70bf92c87a5f19e74bdc894dc2e2fa788439976
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 264B
          • SHA256 5323ea0c2b976cd01692b633b5e9b2de55736fc1dabf73d4fc9bd87bef392709
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Settings.json
          • Path C:\ProgramData\CentraStage\AEMAgent\Settings.json
          • Size 660B
          • SHA256 721560f59645d14e4610c2c341dea3435daeff540758fb07949855dbd307d095
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SharpSnmpLib.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\SharpSnmpLib.dll
          • Size 165KB
          • SHA256 47f1ad495b73857aafcacfb201b1807336dc38ecc22ca3b5416d7176d65fe654
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.CodeDom.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.CodeDom.dll
          • Size 180KB
          • SHA256 2577c92afc28f74c0b74b02d0ef51e15243730f9c4a85d211474f8228f5c15c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Configuration.ConfigurationManager.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Configuration.ConfigurationManager.dll
          • Size 434KB
          • SHA256 39c9852b3f54bec65ddae93f3a02be35a89e96fde007b41f15351d2067e1ba0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.EventLog.Messages.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Diagnostics.EventLog.Messages.dll
          • Size 782KB
          • SHA256 e0acaa275f33f652057c418f3f434f24b65321ecadcc220ffce58f65e2bf47f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.EventLog.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Diagnostics.EventLog.dll
          • Size 172KB
          • SHA256 9177c5434d2872741cf7a80e000c52166fed8930d07ab154c6a4d476d01a9aaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.PerformanceCounter.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Diagnostics.PerformanceCounter.dll
          • Size 136KB
          • SHA256 5327c033dc1750ff807b8f150dec45e72ed9fda3bf05cc98c62b9f0e84df6950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Management.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Management.dll
          • Size 307KB
          • SHA256 503d5e1964effb066721ee14b7dddc07c90de9316343b07ec7bad063ee5d50ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Reactive.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Reactive.dll
          • Size 1.3MB
          • SHA256 c1cae1a8b97d5e0ed64f7a9947f6ae44498398b6e9ee71473c2bef24646e91f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Cryptography.Pkcs.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Security.Cryptography.Pkcs.dll
          • Size 333KB
          • SHA256 d48b9aaa75edfb7a4ce76ac5f0b4e29960b8a134d19bbab1532978dcbeb69dea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Cryptography.ProtectedData.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Security.Cryptography.ProtectedData.dll
          • Size 39KB
          • SHA256 ba98c211f4a5dc9e3023c0db665791338d65f4fded1f812b84bb2608b09e8eb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Cryptography.Xml.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.Security.Cryptography.Xml.dll
          • Size 202KB
          • SHA256 5a2053d5de6bb95ebe57a11fe9b553b9913d87fa4b3744f4e4e10ec4339cb0ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.Duplex.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.Duplex.dll
          • Size 15KB
          • SHA256 5e7d8985922c7d7d673d2d204c2f6d12e3f70f70d0e9ff15507fecd2026a8815
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.Http.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.Http.dll
          • Size 200KB
          • SHA256 f40aa945bfb46b8b545e0b701da75520757a37e9e0544fc2e9d72cdec1ae3faf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.NetFramingBase.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.NetFramingBase.dll
          • Size 194KB
          • SHA256 dd826dfc0eead2b316e422ec4fb0924005b1dfa58f447f2b17a8cc3560453cac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.NetTcp.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.NetTcp.dll
          • Size 62KB
          • SHA256 54362a47ce9c62ae82f43a4577e6c1dbce0a4490269ffe94b11a3a85541f25f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.Primitives.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.Primitives.dll
          • Size 2.3MB
          • SHA256 b20cb0dd2543955fa35457df8334577d0a8ba083b090ce5e146878e0127418b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.Security.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.Security.dll
          • Size 16KB
          • SHA256 99ec51765cf53b36dc1064a48db4c910edb17c92e176e03b947e5e200b82f7d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceModel.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceModel.dll
          • Size 24KB
          • SHA256 cf390c8379f3249937da11dad3a5ba88804a7453503a246be01fc849b899653b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ServiceProcess.ServiceController.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\System.ServiceProcess.ServiceController.dll
          • Size 90KB
          • SHA256 3961824bc760e2e5433c8bec08f85bb4c391ef545a1bed524bcc8cd4217852bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Thoth.Json.Net.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Thoth.Json.Net.dll
          • Size 227KB
          • SHA256 ea2d518863f84785eb1df465366da270fd5109634d84ec0c6f71d86260bb15db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Tommy.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Tommy.dll
          • Size 40KB
          • SHA256 99cdf4436427aa99fed43d4dd6b57755fb3285fe07fe648dfcadadae3763c2ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Util.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\Util.dll
          • Size 3.2MB
          • SHA256 f303f8535601e73e0af606d29442d16ce1a77382a07083dabe32de08904476d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Util.pdb
          • Path C:\ProgramData\CentraStage\AEMAgent\Util.pdb
          • Size 833KB
          • SHA256 f82d67983f0aebc92a819c82d055d167cad9e29337e6e17afcb8d75fb005a5e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          microsoft.management.infrastructure.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\microsoft.management.infrastructure.dll
          • Size 122KB
          • SHA256 50557f6674bc1570308b3f326ae7b6b72839cc9bbac8934ab16ff563178d28f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          microsoft.management.infrastructure.native.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\microsoft.management.infrastructure.native.dll
          • Size 154KB
          • SHA256 ef675cf5c7e0e4ba6291e4644d3ceba378ce9685eb179c6afa8f0bf8f9cadc32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          microsoft.management.infrastructure.native.unmanaged.dll
          • Path C:\ProgramData\CentraStage\AEMAgent\microsoft.management.infrastructure.native.unmanaged.dll
          • Size 27KB
          • SHA256 9bee4e35576355156f00e2e47ef57aa2c8ca64390c112f083a772f2219026293
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nlog.config
          • Path C:\ProgramData\CentraStage\AEMAgent\nlog.config
          • Size 7KB
          • SHA256 0d07920b8d7ccc22a1c37c9ccdbdb3e15586d2406d7408654c59eb0664ed1282
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          desktopshortcut.ico
          • Path C:\ProgramData\CentraStage\Brand\desktopshortcut.ico
          • Size 27KB
          • SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mac_dark_online.ico
          • Path C:\ProgramData\CentraStage\Brand\mac_dark_online.ico
          • Size 5KB
          • SHA256 5504152ef0361c92e32a9c9bf5187656d9219dca029aeac6958d169c324fee8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mac_light_online.ico
          • Path C:\ProgramData\CentraStage\Brand\mac_light_online.ico
          • Size 5KB
          • SHA256 10a10cf0c7d773f917b377705db45bdc399c5058ccefa656b6e63b14fe64d8c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          online.ico
          • Path C:\ProgramData\CentraStage\Brand\online.ico
          • Size 25KB
          • SHA256 1a4b5f05a45dba14e7a6bc15879ac3409148ac090114988cf8b3d2e1af372784
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_agentrto.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_agentrto.ico
          • Size 26KB
          • SHA256 3ac44a3289ec491177ba002d56da9affdd0cb65b54cdb635fd089565865596e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeoffline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeoffline.ico
          • Size 23KB
          • SHA256 c2d7839bc8d14d19cb1ba896a6eede8adcd2d87bb3a7131405f6a6698b388460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_alertmodeonline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_alertmodeonline.ico
          • Size 27KB
          • SHA256 e62b9ca911f2bfd616975f9defe9447d218c279cd0b526a12dc1ad0c42568006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_offline.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_offline.ico
          • Size 20KB
          • SHA256 dc9810b8c280b8ae0b1cd0ce4b8c31632bd3a9e6fcd2e9d3b810853e2a264269
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_privacymode.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_privacymode.ico
          • Size 26KB
          • SHA256 d6d9da4919e2728c2492cbcde91d0066f097039db20a80c633c56900365043ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows_stopped.ico
          • Path C:\ProgramData\CentraStage\Brand\windows_stopped.ico
          • Size 21KB
          • SHA256 330b097786104f9775866fbf3f6194db3272a96961bea578c36eae056f635556
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AEMAgent.exe
          • Path C:\ProgramData\CentraStage\Temp\9b5951a2-53aa-4868-8317-77134d39c0b4\AEMAgent.exe
          • Size 161KB
          • SHA256 941d94981695688546cf03027198b18841d2e2af628a6b172e99b159e87b1ade
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.runtime
          • Path C:\ProgramData\CentraStage\Temp\9b5951a2-53aa-4868-8317-77134d39c0b4\dotnet.runtime
          • Size 291B
          • SHA256 cc08a7357ce4e6239927a6a253f54b373b6e998f8f6fcd7f12a2bfe390129fda
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4trngplj.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\15.1.4.12497\4trngplj.newcfg
          • Size 495B
          • SHA256 8ccea723a793dfbe7e5dc85043e5d1912436fbaeaab2d97017f024981632dada
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\15.1.4.12497\user.config
          • Size 344B
          • SHA256 aa9701ba4e01c83a8e73705476b1f448c67cf549f89a664a64e961aa566e41c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          zyeqpdcf.newcfg
          • Path C:\Users\Admin\AppData\Local\CentraStage\Gui.exe_Url_skipuxqngzysnqnke2ck4pjjmof5uw4s\15.1.4.12497\zyeqpdcf.newcfg
          • Size 1KB
          • SHA256 4b6b97928a3cdccaa73f716238d0dbe5e5e37d0d930472351691c6bacaad8aac
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SimpleFC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\SimpleFC.dll
          • Size 175KB
          • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SimpleSC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\SimpleSC.dll
          • Size 61KB
          • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\System.dll
          • Size 11KB
          • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nsSCM.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\nsSCM.dll
          • Size 5KB
          • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsisXML.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsxFD38.tmp\nsisXML.dll
          • Size 11KB
          • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c3zbxbbj.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\c3zbxbbj.newcfg
          • Size 313B
          • SHA256 3453b4119acf500153287c28003f4b366e73923c8b4512e4eb442a0857a2a13b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          c4kws4gt.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\c4kws4gt.newcfg
          • Size 2KB
          • SHA256 6de97aad75fc9d9342b36a7355aff42444d07bdca2595f0c8fc4eaad56a6f708
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ife2hvfz.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\ife2hvfz.newcfg
          • Size 2KB
          • SHA256 1b4aa8ee71371e8474deb859c3794e9cb0931e7f1c5d0eb8717f1bddc47e8504
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          mobobwlm.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\mobobwlm.newcfg
          • Size 2KB
          • SHA256 5a672d8b95b2c59b3f4da90181f734badd090af59f4b7b672ac8593a692f18ba
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          owizvubh.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\owizvubh.newcfg
          • Size 2KB
          • SHA256 6ed904a987e25081553c8ddec0fcd6bc7ee0c4904adb44b2faf4fcfab01083c9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qxid0grq.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\qxid0grq.newcfg
          • Size 438B
          • SHA256 16dcccbc93066b052e7642f6243e4df36f3e92225ce72c22bb21f64f8fd7fb96
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          spkyzahe.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\spkyzahe.newcfg
          • Size 856B
          • SHA256 772703b814800797a18bde5b8cefb5dbf31f2f4f57c878f17b0f68c20f00afda
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\user.config
          • Size 313B
          • SHA256 ef8bb85857ef71ba9f1b02812f7be72ed1236e3bab16f6aedc91ea8f29269b5e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wdmkpksc.newcfg
          • Path C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage\CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\15.1.4.12497\wdmkpksc.newcfg
          • Size 2KB
          • SHA256 d837db9870a2ec3d3746a5bb7654d7833cec9a422800cc2c1e5d917877320d72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1608-156-0x0000000000540000-0x000000000075E000-memory.dmp
          Download

          memory/1608-215-0x0000000073490000-0x0000000073C4C000-memory.dmp
          Download

          memory/1608-192-0x0000000005C00000-0x0000000005C92000-memory.dmp
          Download

          memory/1608-195-0x0000000006760000-0x00000000069B4000-memory.dmp
          Download

          memory/1608-199-0x0000000073490000-0x0000000073C4C000-memory.dmp
          Download

          memory/1608-159-0x0000000005170000-0x0000000005220000-memory.dmp
          Download

          memory/1608-188-0x0000000006AC0000-0x000000000707A000-memory.dmp
          Download

          memory/1608-183-0x0000000005560000-0x00000000058BB000-memory.dmp
          Download

          memory/1608-184-0x0000000005EE0000-0x00000000064F8000-memory.dmp
          Download

          memory/1608-189-0x00000000734A2000-0x00000000734A3000-memory.dmp
          Download

          memory/4484-200-0x0000000001590000-0x000000000159A000-memory.dmp
          Download

          memory/4484-175-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-275-0x000000001C170000-0x000000001C2C8000-memory.dmp
          Download

          memory/4484-276-0x000000001AEC0000-0x000000001AEE2000-memory.dmp
          Download

          memory/4484-277-0x000000001A320000-0x000000001A338000-memory.dmp
          Download

          memory/4484-300-0x000000001B3C0000-0x000000001B3F4000-memory.dmp
          Download

          memory/4484-507-0x000000001B5A0000-0x000000001B5AA000-memory.dmp
          Download

          memory/4484-511-0x000000001CA50000-0x000000001CA72000-memory.dmp
          Download

          memory/4484-270-0x0000000019FD0000-0x0000000019FE2000-memory.dmp
          Download

          memory/4484-264-0x000000001C060000-0x000000001C16A000-memory.dmp
          Download

          memory/4484-265-0x000000001AE80000-0x000000001AEBA000-memory.dmp
          Download

          memory/4484-253-0x000000001AF20000-0x000000001AFFC000-memory.dmp
          Download

          memory/4484-245-0x000000001ADD0000-0x000000001AE32000-memory.dmp
          Download

          memory/4484-246-0x000000001B100000-0x000000001B3B2000-memory.dmp
          Download

          memory/4484-228-0x000000001B5C0000-0x000000001C05E000-memory.dmp
          Download

          memory/4484-263-0x000000001AE40000-0x000000001AE7C000-memory.dmp
          Download

          memory/4484-612-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-619-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-260-0x000000001B000000-0x000000001B0B2000-memory.dmp
          Download

          memory/4484-154-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-257-0x000000001AD60000-0x000000001ADB0000-memory.dmp
          Download

          memory/4484-185-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-241-0x000000001AD20000-0x000000001AD52000-memory.dmp
          Download

          memory/4484-182-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-620-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-268-0x000000001A030000-0x000000001A05A000-memory.dmp
          Download

          memory/4484-161-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-633-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-506-0x000000001B590000-0x000000001B59C000-memory.dmp
          Download

          memory/4484-150-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-148-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-149-0x000000001A370000-0x000000001A5C4000-memory.dmp
          Download

          memory/4484-146-0x000000001A060000-0x000000001A110000-memory.dmp
          Download

          memory/4484-145-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp
          Download

          memory/4484-143-0x0000000000730000-0x000000000073A000-memory.dmp
          Download

          memory/4484-141-0x00007FFC376FF000-0x00007FFC37700000-memory.dmp
          Download

          memory/4484-435-0x000000001D070000-0x000000001D598000-memory.dmp
          Download

          memory/4484-382-0x000000001CAB0000-0x000000001CB3A000-memory.dmp
          Download

          memory/5852-203-0x0000000006140000-0x00000000061A2000-memory.dmp
          Download

          memory/5852-206-0x00000000061B0000-0x0000000006206000-memory.dmp
          Download

          memory/5852-377-0x000000000AC60000-0x000000000AC6A000-memory.dmp
          Download

          memory/5852-547-0x000000000AD60000-0x000000000AE2E000-memory.dmp
          Download

          memory/5852-546-0x000000000B730000-0x000000000C1CE000-memory.dmp
          Download

          memory/5852-269-0x0000000006F50000-0x0000000006F5A000-memory.dmp
          Download

          memory/5852-354-0x000000000AB10000-0x000000000AB60000-memory.dmp
          Download

          memory/5932-0-0x0000000000438000-0x0000000000439000-memory.dmp
          Download

          memory/5932-122-0x0000000002650000-0x0000000002663000-memory.dmp
          Download

          memory/5932-84-0x0000000002640000-0x0000000002670000-memory.dmp
          Download

          memory/5932-181-0x0000000000400000-0x000000000044E000-memory.dmp
          Download

          memory/5932-60-0x0000000000400000-0x000000000044E000-memory.dmp
          Download