Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CentraStage' = '%ProgramFiles(x86)%\CentraStage\Gui.exe'
- [<HKLM>\SOFTWARE\CLASSES\cag\shell\open\command] '' = '"%ProgramFiles(x86)%\CentraStage\Gui.exe" %1'
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CagService] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\CagService.exe"'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service'
Создает следующие сервисы
- 'CagService' "%ProgramFiles(x86)%\CentraStage\CagService.exe"
- 'CagService' %ProgramFiles(x86)%\CentraStage\CagService.exe
- 'uvnc_service' "%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RMM WINVNC" dir=out action=block program="%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Aria" dir=in action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\aria2c.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Aria" dir=out action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\aria2c.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="%ALLUSERSPROFILE%\CentraStage\AEMAgent\AEMAgent.exe" enable=yes
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nshd7e8.tmp\system.dll
- %ALLUSERSPROFILE%\centrastage\aemagent\branding.ico
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\inc2envn.newcfg
- %ALLUSERSPROFILE%\centrastage\aemagent\settings.json
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\c1oeaa51.newcfg
- %WINDIR%\temp\cab6509.tmp
- %WINDIR%\temp\tar650a.tmp
- %WINDIR%\temp\cab652a.tmp
- %WINDIR%\temp\tar652b.tmp
- %WINDIR%\temp\cab7b5a.tmp
- %WINDIR%\temp\tar7b5b.tmp
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\3n1xxnug.newcfg
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\v4y5f4bp.newcfg
- %WINDIR%\temp\cab92f2.tmp
- %WINDIR%\temp\tar9302.tmp
- %WINDIR%\temp\caba8b5.tmp
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_stopped.ico
- %WINDIR%\temp\tara8c6.tmp
- %ALLUSERSPROFILE%\centrastage\brand\windows_stopped.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\online.ico
- %ALLUSERSPROFILE%\centrastage\brand\patchrebootwindow.png
- %ALLUSERSPROFILE%\centrastage\brand\primarylogo.png
- %ALLUSERSPROFILE%\centrastage\brand\privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\stopped.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\windows_privacymode.ico
- %WINDIR%\temp\caba905.tmp
- %WINDIR%\temp\tara906.tmp
- %WINDIR%\temp\caba936.tmp
- %WINDIR%\temp\tmp605\build\nlog.config
- %WINDIR%\temp\tmp605\build\dotnet.runtime
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\m21iy3gy.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\ciow14gy.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\4vh3bp1j.newcfg
- %ALLUSERSPROFILE%\centrastage\packages\07a4e525-dc73-6bc1-7cf8-f213218c037d.resume
- nul
- %ProgramFiles(x86)%\centrastage\ultravnc\vnc.zip.resume
- %ProgramFiles(x86)%\centrastage\ultravnc\cad.exe
- %ProgramFiles(x86)%\centrastage\ultravnc\gnu.txt
- %ProgramFiles(x86)%\centrastage\ultravnc\schook.dll
- %ProgramFiles(x86)%\centrastage\ultravnc\ultravnc.ini
- %ProgramFiles(x86)%\centrastage\ultravnc\vnc_configure.cmd
- %ProgramFiles(x86)%\centrastage\ultravnc\winvnc.exe
- %WINDIR%\temp\tmp605\build\aria2c.exe
- %WINDIR%\temp\tmp605\build\aemagent.exe.config
- %WINDIR%\temp\tmp605\build\aemagent.exe
- %WINDIR%\temp\tmp605\aemagentwindeploy.3.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\ohmtcldj.newcfg
- %WINDIR%\temp\cabbee9.tmp
- %WINDIR%\temp\tarbeea.tmp
- %WINDIR%\temp\cabbf1a.tmp
- %WINDIR%\temp\tarbf1b.tmp
- %WINDIR%\temp\cabd4be.tmp
- %WINDIR%\temp\tard4bf.tmp
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_offline.ico
- %WINDIR%\temp\tard4f0.tmp
- %WINDIR%\temp\cabd4df.tmp
- %WINDIR%\temp\tareaa4.tmp
- %WINDIR%\temp\cabead3.tmp
- %WINDIR%\temp\taread4.tmp
- %WINDIR%\temp\cab97.tmp
- %WINDIR%\temp\tar98.tmp
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.zip.resume
- %WINDIR%\temp\tara937.tmp
- %WINDIR%\temp\cabeaa3.tmp
- %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe.resume
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeoffline.ico
- %ProgramFiles(x86)%\centrastage\smartthreadpool.dll
- %ProgramFiles(x86)%\centrastage\nlog.dll
- %ProgramFiles(x86)%\centrastage\snmp.dll
- %ProgramFiles(x86)%\centrastage\snmpsharpnet.dll
- %ProgramFiles(x86)%\centrastage\system.io.dll
- %ProgramFiles(x86)%\centrastage\system.runtime.dll
- %ProgramFiles(x86)%\centrastage\system.threading.tasks.dll
- %ProgramFiles(x86)%\centrastage\transitions.dll
- %ProgramFiles(x86)%\centrastage\weifenluo.winformsui.docking.dll
- %ProgramFiles(x86)%\centrastage\interop.mstsclib.dll
- %ProgramFiles(x86)%\centrastage\scvncctrl.dll
- %ProgramFiles(x86)%\centrastage\interop.viewerx.dll
- %ProgramFiles(x86)%\centrastage\windowsagent.dll
- %ProgramFiles(x86)%\centrastage\microsoft.web.services3.dll
- %ProgramFiles(x86)%\centrastage\csexec.service.exe
- %ProgramFiles(x86)%\centrastage\nlog.config
- %ProgramFiles(x86)%\centrastage\putty.exe
- %ProgramFiles(x86)%\centrastage\newtonsoft.json.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.desktop.dll
- %ProgramFiles(x86)%\centrastage\csicon.ico
- %ProgramFiles(x86)%\centrastage\defaultbrand.zip
- %ProgramFiles(x86)%\centrastage\axinterop.mstsclib.dll
- %ProgramFiles(x86)%\centrastage\axinterop.viewerx.dll
- %ProgramFiles(x86)%\centrastage\cagservice.exe
- %ProgramFiles(x86)%\centrastage\cagservice.exe.config
- %ProgramFiles(x86)%\centrastage\common.dll
- %ProgramFiles(x86)%\centrastage\core.dll
- %ProgramFiles(x86)%\centrastage\core.xmlserializers.dll
- %ProgramFiles(x86)%\centrastage\fsharp.core.dll
- %ProgramFiles(x86)%\centrastage\fslexyacc.runtime.dll
- %ProgramFiles(x86)%\centrastage\gui.exe
- %ProgramFiles(x86)%\centrastage\gui.exe.config
- %ProgramFiles(x86)%\centrastage\icsharpcode.sharpziplib.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.dll
- %ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.dll
- %ProgramFiles(x86)%\centrastage\vim25service.dll
- %ProgramFiles(x86)%\centrastage\vim25service.xmlserializers.dll
- %ProgramFiles(x86)%\centrastage\es\gui.resources.dll
- %ALLUSERSPROFILE%\centrastage\packages\07a4e525-dc73-6bc1-7cf8-f213218c037d
- %ALLUSERSPROFILE%\centrastage\brand\agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\alertmodeoffline.ico
- %ALLUSERSPROFILE%\centrastage\brand\alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\desktopshortcut.ico
- %ALLUSERSPROFILE%\centrastage\brand\keys.xml
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_agentrto.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeonline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_offline.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_ondemandmode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_online.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_privacymode.ico
- %ALLUSERSPROFILE%\centrastage\brand\mac_dark_stopped.ico
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\e5jt3qce.newcfg
- %ALLUSERSPROFILE%\centrastage\monitoring\deviceuptimeperformancemonitorv2.xml
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\r2kypgtp.newcfg
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\1eeerj2e.newcfg
- %ProgramFiles(x86)%\centrastage\log.txt
- %ProgramFiles(x86)%\centrastage\fr\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\it\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\pt\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\sv\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\hu\gui.resources.dll
- %ProgramFiles(x86)%\centrastage\nl\gui.resources.dll
- %ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeoffline.ico
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent monitor.lnk
- %TEMP%\nshd7e8.tmp\nsisxml.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\uninstall agent.lnk
- %TEMP%\nshd7e8.tmp\simplefc.dll
- %TEMP%\nshd7e8.tmp\nsprocess.dll
- %TEMP%\nshd7e8.tmp\nsscm.dll
- %TEMP%\nshd7e8.tmp\simplesc.dll
- %ProgramFiles(x86)%\centrastage\uninst.exe
- %ProgramFiles(x86)%\centrastage\de\gui.resources.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent browser.lnk
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\raak1ntx.newcfg
Удаляет следующие файлы
- %TEMP%\nshd7e8.tmp\nsisxml.dll
- %WINDIR%\temp\tarbeea.tmp
- %WINDIR%\temp\cabbf1a.tmp
- %WINDIR%\temp\tarbf1b.tmp
- %WINDIR%\temp\cabd4be.tmp
- %WINDIR%\temp\tard4bf.tmp
- %WINDIR%\temp\cabd4df.tmp
- %WINDIR%\temp\tard4f0.tmp
- %WINDIR%\temp\tareaa4.tmp
- %WINDIR%\temp\tmp605\aemagentwindeploy.3.zip
- %WINDIR%\temp\cabead3.tmp
- %WINDIR%\temp\taread4.tmp
- %WINDIR%\temp\cab97.tmp
- %WINDIR%\temp\tar98.tmp
- %ALLUSERSPROFILE%\centrastage\packages\07a4e525-dc73-6bc1-7cf8-f213218c037d
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.2.zip
- %ProgramFiles(x86)%\centrastage\ultravnc\vnc.zip
- %WINDIR%\temp\cabbee9.tmp
- %WINDIR%\temp\cabeaa3.tmp
- %WINDIR%\temp\tara937.tmp
- %WINDIR%\temp\cab652a.tmp
- %TEMP%\nshd7e8.tmp\nsprocess.dll
- %TEMP%\nshd7e8.tmp\nsscm.dll
- %TEMP%\nshd7e8.tmp\simplefc.dll
- %TEMP%\nshd7e8.tmp\simplesc.dll
- %TEMP%\nshd7e8.tmp\system.dll
- %WINDIR%\temp\cab6509.tmp
- %WINDIR%\temp\tar650a.tmp
- %WINDIR%\temp\tar652b.tmp
- %WINDIR%\temp\tara906.tmp
- %WINDIR%\temp\cab7b5a.tmp
- %WINDIR%\temp\tar7b5b.tmp
- %WINDIR%\temp\cab92f2.tmp
- %WINDIR%\temp\tar9302.tmp
- %WINDIR%\temp\caba8b5.tmp
- %WINDIR%\temp\tara8c6.tmp
- %WINDIR%\temp\caba905.tmp
- %WINDIR%\temp\caba936.tmp
- %ProgramFiles(x86)%\centrastage\ultravnc\vnc_configure.cmd
Перемещает следующие файлы
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\1eeerj2e.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- %WINDIR%\temp\tmp605\nlog.config в %ALLUSERSPROFILE%\centrastage\aemagent\nlog.config
- %WINDIR%\temp\tmp605\dotnet.runtime в %ALLUSERSPROFILE%\centrastage\aemagent\dotnet.runtime
- %WINDIR%\temp\tmp605\aria2c.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe
- %WINDIR%\temp\tmp605\aemagent.exe.config в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe.config
- %WINDIR%\temp\tmp605\aemagent.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe
- %ProgramFiles(x86)%\centrastage\ultravnc\vnc.zip.resume в %ProgramFiles(x86)%\centrastage\ultravnc\vnc.zip
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.zip в %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.2.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\4vh3bp1j.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\ciow14gy.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\m21iy3gy.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- %WINDIR%\temp\tmp605\build\nlog.config в %WINDIR%\temp\tmp605\nlog.config
- %WINDIR%\temp\tmp605\build\dotnet.runtime в %WINDIR%\temp\tmp605\dotnet.runtime
- %WINDIR%\temp\tmp605\build\aria2c.exe в %WINDIR%\temp\tmp605\aria2c.exe
- %WINDIR%\temp\tmp605\build\aemagent.exe.config в %WINDIR%\temp\tmp605\aemagent.exe.config
- %WINDIR%\temp\tmp605\build\aemagent.exe в %WINDIR%\temp\tmp605\aemagent.exe
- %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.zip.resume в %ALLUSERSPROFILE%\centrastage\aemagent\aemagentdeploy.9.2.0.3.zip
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\ohmtcldj.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\v4y5f4bp.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\user.config
- %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\3n1xxnug.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\c1oeaa51.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\inc2envn.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\e5jt3qce.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\r2kypgtp.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\raak1ntx.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2128.2128\user.config
- %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe.resume в %ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe
Подменяет следующие файлы
- %ALLUSERSPROFILE%\centrastage\packages\07a4e525-dc73-6bc1-7cf8-f213218c037d
Сетевая активность
Подключается к
- '01##.##ntrastage.net':443
- 'pi#######agent.centrastage.net':443
- 'up####.centrastage.net':443
- 'x.##2.us':80
- 'microsoft.com':80
- 'up#######notage.centrastage.net':443
TCP
- '01##.##ntrastage.net':443
- 'pi#######agent.centrastage.net':443
- 'up####.centrastage.net':443
UDP
- DNS ASK 01##.##ntrastage.net
- DNS ASK pi#######agent.centrastage.net
- DNS ASK up####.centrastage.net
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK up#######notage.centrastage.net
Другое
Создает и запускает на исполнение
- '%ProgramFiles(x86)%\centrastage\cagservice.exe'
- '%ProgramFiles(x86)%\centrastage\gui.exe'
- '%WINDIR%\temp\tmp605\aemagent.exe' --version
- '%ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe'
- '%ALLUSERSPROFILE%\centrastage\splashtop\splashtop_streamer.exe' prevercheck /s /i autologin=1,hidewindow=1,autoupdate=0,confirm_d=0,reqsyspwd=0,loopback=1
- '%ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe' --show-console-readout=false --max-download-result=0 --log=aria.log --enable-rpc=true --summary-interval=10 --dir=%ALLUSERSPROFILE%\CentraStage\AEMAgent\Downloads --file-allocation=none --log-l...
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\CentraStage\scvncctrl.dll"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RMM WINVNC"
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles(x86)%\CentraStage\UltraVNC\vnc_configure.cmd" %ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe"
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq winvnc.exe"
- '<SYSTEM32>\find.exe' ":"
- '<SYSTEM32>\sc.exe' create uvnc_service binpath= "\"%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe\" -service" start= auto
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Aria"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AEMAgent"
- '%WINDIR%\syswow64\msiexec.exe' /norestart /i "setup.msi" /qn /l*v "%WINDIR%\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="autologin=1,hidewindow=1,autoupdate=0,confirm_d=0,reqsyspwd=0,loopback=1"
