Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CentraStage' = '%ProgramFiles(x86)%\CentraStage\Gui.exe'
- [<HKLM>\SOFTWARE\CLASSES\cag\shell\open\command] '' = '"%ProgramFiles(x86)%\CentraStage\Gui.exe" %1'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\CagService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service'
Создает следующие сервисы
- 'CagService' "%ProgramFiles(x86)%\CentraStage\CagService.exe"
- 'CagService' %ProgramFiles(x86)%\CentraStage\CagService.exe
- 'uvnc_service' "%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RMM WINVNC" dir=out action=block program="%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" enable=yes
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRServer.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRApp.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRFeature.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRFeatMini.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRManager.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRAgent.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SRChat.exe /T
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Aria" dir=in action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\aria2c.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Aria" dir=out action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\aria2c.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsn5d5c.tmp\system.dll
- %WINDIR%\temp\cab21c8.tmp
- %WINDIR%\temp\tar21c9.tmp
- %WINDIR%\temp\cab374d.tmp
- %WINDIR%\temp\tar374e.tmp
- %WINDIR%\temp\cab379d.tmp
- %WINDIR%\temp\tar37ae.tmp
- %WINDIR%\temp\cab37be.tmp
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\gefkj40u.newcfg
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\g1udv155.newcfg
- %WINDIR%\temp\tar37bf.tmp
- %WINDIR%\temp\cab4d35.tmp
- %WINDIR%\temp\tar4d36.tmp
- %WINDIR%\temp\cab625d.tmp
- %WINDIR%\temp\tar625e.tmp
- %WINDIR%\temp\cab626e.tmp
- %WINDIR%\temp\tar627f.tmp
- %WINDIR%\temp\cab77b5.tmp
- %WINDIR%\temp\cab4d14.tmp
- %WINDIR%\temp\tar4d15.tmp
- %WINDIR%\temp\tarb89.tmp
- %WINDIR%\temp\cabb88.tmp
- %WINDIR%\temp\tarf5a7.tmp
- %ALLUSERSPROFILE%\centrastage\brand\privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\stopped.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\primarylogo.png
- %ALLUSERSPROFILE%\centrastage\brand\windows_privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_stopped.ico
- %ALLUSERSPROFILE%\centrastage\aemagent\branding.ico
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\e4s15jgf.newcfg
- %ALLUSERSPROFILE%\centrastage\aemagent\settings.json
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\zjoq2odc.newcfg
- %WINDIR%\temp\cabf584.tmp
- %WINDIR%\temp\tarf585.tmp
- %WINDIR%\temp\cabf5a6.tmp
- %ALLUSERSPROFILE%\centrastage\brand\windows_stopped.ico
- %WINDIR%\temp\tar77b6.tmp
- %WINDIR%\temp\tar77d7.tmp
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\string1033.txt
- %WINDIR%\temp\cab8d1c.tmp
- %WINDIR%\temp\prever.log.txt
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setup.ini
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\setuputil.exe
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\splashtop_software_updater.exe
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\ssu_clean.exe
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\description.xml
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\pinshortcut.exe
- %WINDIR%\temp\unpack\uninst.iss
- %WINDIR%\temp\prever.log
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_inst.reg
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x86.dll
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_x64.dll
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isconfig.ini
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\setup.inx
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isrt.dll
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\_isres_0x0409.dll
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\credprovider_uninst.reg
- %WINDIR%\temp\{b7c5ea94-b96a-41f5-be95-25d78b486678}\stevt_srs_provider.man
- %WINDIR%\temp\unpack\prevercheck.exe
- %WINDIR%\temp\unpack\setup.ini
- %WINDIR%\temp\unpack\run.bat
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.zip.resume
- %WINDIR%\temp\tmp8ef2\aemagentwindeploy.8.zip
- %WINDIR%\temp\tmp8ef2\build\aemagent.exe
- %WINDIR%\temp\tmp8ef2\build\aria2c.exe
- %WINDIR%\temp\tmp8ef2\build\aemagent.exe.config
- %WINDIR%\temp\tmp8ef2\build\nlog.config
- %WINDIR%\temp\tmp8ef2\build\dotnet.runtime
- %WINDIR%\temp\tmp8ef2\build\rmm.webremote.net4.9.1.0.8.zip
- %WINDIR%\temp\tar8d1d.tmp
- %WINDIR%\temp\tmp8ef2\build\rmm.webremote.deps.net4.9.1.0.8.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\5fyskaan.newcfg
- %ALLUSERSPROFILE%\centrastage\packages\a68821bb-16fd-7ca3-e799-70db165ccd1c.resume
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\4tt552ds.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\vr1y0cwq.newcfg
- %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe.resume
- %WINDIR%\temp\unpack.log
- %WINDIR%\temp\unpack\setup.msi
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\bwvllj0u.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\ztdh3joc.newcfg
- %ALLUSERSPROFILE%\centrastage\brand\patchrebootwindow.png
- %WINDIR%\temp\cab77d6.tmp
- %ALLUSERSPROFILE%\centrastage\brand\online.ico
- %ProgramFiles(x86)%\centrastage\es\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\system.runtime.dll
- %ProgramFiles(x86)%\centrastage\system.threading.tasks.dll
- %ProgramFiles(x86)%\centrastage\transitions.dll
- %ProgramFiles(x86)%\centrastage\weifenluo.winformsui.docking.dll
- %ProgramFiles(x86)%\centrastage\interop.mstsclib.dll
- %ProgramFiles(x86)%\centrastage\interop.viewerx.dll
- %ProgramFiles(x86)%\centrastage\scvncctrl.dll
- %ProgramFiles(x86)%\centrastage\snmpsharpnet.dll
- %ProgramFiles(x86)%\centrastage\system.io.dll
- %ProgramFiles(x86)%\centrastage\windowsagent.dll
- %ProgramFiles(x86)%\centrastage\putty.exe
- %ProgramFiles(x86)%\centrastage\vim25service.dll
- %ProgramFiles(x86)%\centrastage\vim25service.xmlserializers.dll
- %ProgramFiles(x86)%\centrastage\ultravnc\cad.exe
- %ProgramFiles(x86)%\centrastage\ultravnc\schook.dll
- %ProgramFiles(x86)%\centrastage\ultravnc\winvnc.exe
- %ProgramFiles(x86)%\centrastage\ultravnc\ultravnc.ini
- %ProgramFiles(x86)%\centrastage\microsoft.web.services3.dll
- %ProgramFiles(x86)%\centrastage\csexec.service.exe
- %ProgramFiles(x86)%\centrastage\snmp.dll
- %ProgramFiles(x86)%\centrastage\nlog.dll
- %ProgramFiles(x86)%\centrastage\smartthreadpool.dll
- %ProgramFiles(x86)%\centrastage\defaultbrand.zip
- %ProgramFiles(x86)%\centrastage\axinterop.mstsclib.dll
- %ProgramFiles(x86)%\centrastage\axinterop.viewerx.dll
- %ProgramFiles(x86)%\centrastage\cagservice.exe
- %ProgramFiles(x86)%\centrastage\cagservice.exe.config
- %ProgramFiles(x86)%\centrastage\common.dll
- %ProgramFiles(x86)%\centrastage\core.dll
- %ProgramFiles(x86)%\centrastage\core.xmlserializers.dll
- %ProgramFiles(x86)%\centrastage\csicon.ico
- %ProgramFiles(x86)%\centrastage\fsharp.core.dll
- %ProgramFiles(x86)%\centrastage\gui.exe
- %ProgramFiles(x86)%\centrastage\gui.exe.config
- %ProgramFiles(x86)%\centrastage\icsharpcode.sharpziplib.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.desktop.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.dll
- %ProgramFiles(x86)%\centrastage\newtonsoft.json.dll
- %ProgramFiles(x86)%\centrastage\nlog.config
- %ProgramFiles(x86)%\centrastage\fslexyacc.runtime.dll
- %ProgramFiles(x86)%\centrastage\ultravnc\gnu.txt
- %ProgramFiles(x86)%\centrastage\de\gui.resources.dll
- %ALLUSERSPROFILE%\centrastage\brand\offline.ico
- %ProgramFiles(x86)%\centrastage\fr\gui.resources.dll
- %ALLUSERSPROFILE%\centrastage\brand\desktopshortcut.ico
- %ALLUSERSPROFILE%\centrastage\brand\keys.xml
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_stopped.ico
- %ALLUSERSPROFILE%\centrastage\brand\agentrto.ico
- %ALLUSERSPROFILE%\centrastage\packages\a68821bb-16fd-7ca3-e799-70db165ccd1c
- %ALLUSERSPROFILE%\centrastage\monitoring\deviceuptimeperformancemonitorv2.xml
- %ProgramFiles(x86)%\centrastage\pt\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\sv\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\hu\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\nl\gui.resources.dll
- %TEMP%\nsn5d5c.tmp\nsisxml.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent monitor.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent browser.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\uninstall agent.lnk
- %ProgramFiles(x86)%\centrastage\it\gui.resources.dll
- %TEMP%\nsn5d5c.tmp\simplefc.dll
- %TEMP%\nsn5d5c.tmp\nsscm.dll
- %TEMP%\nsn5d5c.tmp\simplesc.dll
- %TEMP%\nsn5d5c.tmp\nsexec.dll
- %ProgramFiles(x86)%\centrastage\log.txt
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\5vkuw31n.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\imzjeohj.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\1c1ddj4y.newcfg
- %ProgramFiles(x86)%\centrastage\uninst.exe
- %TEMP%\nsn5d5c.tmp\nsprocess.dll
- %ALLUSERSPROFILE%\centrastage\brand\ondemandmode.ico
- %WINDIR%\temp\~df225d71bfbed3ec21.tmp
Удаляет следующие файлы
- %TEMP%\nsn5d5c.tmp\nsexec.dll
- %WINDIR%\temp\cab625d.tmp
- %WINDIR%\temp\tar625e.tmp
- %WINDIR%\temp\cab626e.tmp
- %WINDIR%\temp\tar627f.tmp
- %WINDIR%\temp\cab77b5.tmp
- %WINDIR%\temp\tar77b6.tmp
- %WINDIR%\temp\cab77d6.tmp
- %WINDIR%\temp\cab4d35.tmp
- %WINDIR%\temp\tar4d36.tmp
- %WINDIR%\temp\tar77d7.tmp
- %ALLUSERSPROFILE%\centrastage\packages\a68821bb-16fd-7ca3-e799-70db165ccd1c
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.2.zip
- %WINDIR%\temp\tmp8ef2\aemagentwindeploy.8.zip
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isrt.dll
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isconfig.ini
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\string1033.txt
- %WINDIR%\temp\cab8d1c.tmp
- %WINDIR%\temp\tar8d1d.tmp
- %WINDIR%\temp\tar4d15.tmp
- %WINDIR%\temp\cab4d14.tmp
- %WINDIR%\temp\tar37bf.tmp
- %TEMP%\nsn5d5c.tmp\nsprocess.dll
- %TEMP%\nsn5d5c.tmp\nsscm.dll
- %TEMP%\nsn5d5c.tmp\simplefc.dll
- %TEMP%\nsn5d5c.tmp\simplesc.dll
- %TEMP%\nsn5d5c.tmp\system.dll
- %WINDIR%\temp\cabf584.tmp
- %WINDIR%\temp\tarf585.tmp
- %WINDIR%\temp\cabf5a6.tmp
- %TEMP%\nsn5d5c.tmp\nsisxml.dll
- %WINDIR%\temp\tarf5a7.tmp
- %WINDIR%\temp\tarb89.tmp
- %WINDIR%\temp\cab21c8.tmp
- %WINDIR%\temp\tar21c9.tmp
- %WINDIR%\temp\cab374d.tmp
- %WINDIR%\temp\tar374e.tmp
- %WINDIR%\temp\cab379d.tmp
- %WINDIR%\temp\tar37ae.tmp
- %WINDIR%\temp\cab37be.tmp
- %WINDIR%\temp\cabb88.tmp
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\_isres_0x0409.dll
- %WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\setup.inx
Перемещает следующие файлы
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\5vkuw31n.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- %WINDIR%\temp\tmp8ef2\rmm.webremote.net4.9.1.0.8.zip в %ALLUSERSPROFILE%\centrastage\aemagent\rmm.webremote.net4.9.1.0.8.zip
- %WINDIR%\temp\tmp8ef2\rmm.webremote.deps.net4.9.1.0.8.zip в %ALLUSERSPROFILE%\centrastage\aemagent\rmm.webremote.deps.net4.9.1.0.8.zip
- %WINDIR%\temp\tmp8ef2\nlog.config в %ALLUSERSPROFILE%\centrastage\aemagent\nlog.config
- %WINDIR%\temp\tmp8ef2\dotnet.runtime в %ALLUSERSPROFILE%\centrastage\aemagent\dotnet.runtime
- %WINDIR%\temp\tmp8ef2\aria2c.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe
- %WINDIR%\temp\tmp8ef2\aemagent.exe.config в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe.config
- %WINDIR%\temp\tmp8ef2\aemagent.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\vr1y0cwq.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\4tt552ds.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.zip в %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.2.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\5fyskaan.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\ztdh3joc.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe.resume в %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe
- %WINDIR%\temp\tmp8ef2\build\rmm.webremote.net4.9.1.0.8.zip в %WINDIR%\temp\tmp8ef2\rmm.webremote.net4.9.1.0.8.zip
- %WINDIR%\temp\tmp8ef2\build\nlog.config в %WINDIR%\temp\tmp8ef2\nlog.config
- %WINDIR%\temp\tmp8ef2\build\dotnet.runtime в %WINDIR%\temp\tmp8ef2\dotnet.runtime
- %WINDIR%\temp\tmp8ef2\build\aria2c.exe в %WINDIR%\temp\tmp8ef2\aria2c.exe
- %WINDIR%\temp\tmp8ef2\build\aemagent.exe.config в %WINDIR%\temp\tmp8ef2\aemagent.exe.config
- %WINDIR%\temp\tmp8ef2\build\aemagent.exe в %WINDIR%\temp\tmp8ef2\aemagent.exe
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.zip.resume в %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.1.0.8.zip
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\g1udv155.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\user.config
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\gefkj40u.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\zjoq2odc.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\e4s15jgf.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\1c1ddj4y.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\imzjeohj.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
- %WINDIR%\temp\tmp8ef2\build\rmm.webremote.deps.net4.9.1.0.8.zip в %WINDIR%\temp\tmp8ef2\rmm.webremote.deps.net4.9.1.0.8.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\bwvllj0u.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2125.2125\user.config
Подменяет следующие файлы
- %ALLUSERSPROFILE%\centrastage\packages\a68821bb-16fd-7ca3-e799-70db165ccd1c
Сетевая активность
Подключается к
- '01##.##ntrastage.net':443
- 'pi#######agent.centrastage.net':443
- 'up####.centrastage.net':443
- 'x.##2.us':80
- 'microsoft.com':80
- 'public-trust.com':80
TCP
- '01##.##ntrastage.net':443
- 'pi#######agent.centrastage.net':443
- 'up####.centrastage.net':443
UDP
- DNS ASK 01##.##ntrastage.net
- DNS ASK pi#######agent.centrastage.net
- DNS ASK up####.centrastage.net
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK public-trust.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'MsiDialogCloseClass' WindowName: ''
- ClassName: '#32770' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\centrastage\cagservice.exe'
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16C1FD05-DA95-4721-B6B4-68C1B99ED5CC}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D495CE4-EBDB-4F30-8B8C-48BC4BCC3D48}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{90AD1EE3-4F19-4122-9365-59A7F143E796}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C4023F8-A27D-4C00-9221-C6FAC23DBE4F}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8D83CC68-62A3-4060-9CDE-4B1346A4D563}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{72A600F5-C983-478B-A7E0-B4B2073B5859}
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C7CD7B6-C1F3-4CA4-9A03-A6F09BF498D7}
- '%ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe'
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C823276-DB3E-4E4E-B5FB-14D0C0CB2F41}
- '%WINDIR%\temp\unpack\prevercheck.exe' /s /i autologin=1,hidewindow=1,autoupdate=0,confirm_d=0,reqsyspwd=0,loopback=1
- '%ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe' prevercheck /s /i autologin=1,hidewindow=1,autoupdate=0,confirm_d=0,reqsyspwd=0,loopback=1
- '%WINDIR%\temp\tmp8ef2\aemagent.exe' --version
- '%ProgramFiles(x86)%\centrastage\gui.exe'
- '%ProgramFiles(x86)%\centrastage\ultravnc\winvnc.exe' -service
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11A1E01D-394E-4FC2-A850-A85DDBB263F3}
- '%ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe' --show-console-readout=false --max-download-result=0 --log=aria.log --enable-rpc=true --summary-interval=10 --dir=%ALLUSERSPROFILE%\CentraStage\AEMAgent\Downloads --file-allocation=none --log-l...
- '%WINDIR%\temp\{7b976b5d-3cda-40f1-82a8-46348bb49117}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4CA075B6-1F0E-4BCF-B1A1-EA9FFC7579A4}
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeatMini.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRManager.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRChat.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRServer.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRApp.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeature.exe /T"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRAgent.exe /T"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RMM WINVNC"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\CentraStage\scvncctrl.dll"
- '%WINDIR%\syswow64\msiexec.exe' /norestart /i "setup.msi" /qn /l*v "%WINDIR%\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="autologin=1,hidewindow=1,autoupdate=0,confirm_d=0,reqsyspwd=0,loopback=1"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRServer.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRApp.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeature.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRFeatMini.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRManager.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRAgent.exe /T"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill.exe /F /IM SRChat.exe /T"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Aria"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AEMAgent"
