| URL: | https://worexa.icu//Document/Confidential_Document.exe |
| Full analysis: | https://app.any.run/tasks/9d3d4c64-6b50-43e2-8577-b99d63690011 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 10, 2026, 16:18:10 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 4956484A509059C61A15208BB6FF921D |
| SHA1: | 0761CF4FBA8B190D5FB4BF5B57B617985176424F |
| SHA256: | 6CF038CBC8CF06216E8E9891CA0EFA09AFD4DDB411238F7C304C18FBC2D67D8B |
| SSDEEP: | 3:N8bXAdZhKf9W2dde0dAn:2sdZhKFWLn |
MALICIOUS
Changes the autorun value in the registry
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
Registers / Runs the DLL via REGSVR32.EXE
- CagService.exe (PID: 8660)
DATTO has been detected
- CagService.exe (PID: 8660)
SUSPICIOUS
The process creates files with name similar to system file names
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
Malware-specific behavior (creating "System.dll" in Temp)
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
Executable content was dropped or overwritten
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
- CagService.exe (PID: 8660)
Executes as Windows Service
- CagService.exe (PID: 8660)
Creates or modifies Windows services
- CagService.exe (PID: 8660)
Searches for installed software
- CagService.exe (PID: 8660)
Creates/Modifies COM task schedule object
- regsvr32.exe (PID: 8932)
INFO
Reads Environment values
- identity_helper.exe (PID: 7352)
- CagService.exe (PID: 8660)
Reads the computer name
- identity_helper.exe (PID: 7352)
- Confidential_Document.exe (PID: 8436)
- CagService.exe (PID: 8660)
- Gui.exe (PID: 8748)
- Confidential_Document.exe (PID: 8236)
- Gui.exe (PID: 5772)
Application launched itself
- msedge.exe (PID: 3276)
Executable content was dropped or overwritten
- msedge.exe (PID: 3276)
- msedge.exe (PID: 7172)
Checks supported languages
- identity_helper.exe (PID: 7352)
- Confidential_Document.exe (PID: 8436)
- Gui.exe (PID: 8748)
- CagService.exe (PID: 8660)
- Confidential_Document.exe (PID: 8236)
- Gui.exe (PID: 5772)
Launching a file from the Downloads directory
- msedge.exe (PID: 3276)
DATTO has been detected
- msedge.exe (PID: 3276)
- Confidential_Document.exe (PID: 8436)
- CagService.exe (PID: 8660)
- CagService.exe (PID: 8660)
- Gui.exe (PID: 8748)
- Confidential_Document.exe (PID: 8236)
- Gui.exe (PID: 5772)
Create files in a temporary directory
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
The sample compiled with english language support
- Confidential_Document.exe (PID: 8436)
- CagService.exe (PID: 8660)
There is functionality for taking screenshot (YARA)
- Confidential_Document.exe (PID: 8436)
Launching a file from a Registry key
- Confidential_Document.exe (PID: 8436)
- Confidential_Document.exe (PID: 8236)
Creates a software uninstall entry
- Confidential_Document.exe (PID: 8436)
- CagService.exe (PID: 8660)
- Confidential_Document.exe (PID: 8236)
Reads the machine GUID from the registry
- CagService.exe (PID: 8660)
- Gui.exe (PID: 8748)
- Gui.exe (PID: 5772)
Creates files or folders in the user directory
- Gui.exe (PID: 8748)
Reads security settings of Internet Explorer
- CagService.exe (PID: 8660)
- Gui.exe (PID: 8748)
- Gui.exe (PID: 5772)
Disables trace logs
- CagService.exe (PID: 8660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
169
Monitored processes
34
Malicious processes
1
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 572 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5968,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2420 | "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6540,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: PWA Identity Proxy Host Exit code: 3221226029 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2420 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6356,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2684 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6344,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2960 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5964,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3276 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-features=HttpsUpgrades,HttpsFirstModeV2,HttpsOnlyMode,HttpsFirstBalancedMode --no-first-run --no-default-browser-check https://worexa.icu//Document/Confidential_Document.exe | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3324 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffe233cf208,0x7ffe233cf214,0x7ffe233cf220 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3552 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3692 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2756,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4692 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5248,i,13544827358520942775,15490377799545477505,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
9 152
Read events
9 093
Write events
59
Delete events
0
Modification events
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | CentraStage |
Value: C:\Program Files (x86)\CentraStage\Gui.exe | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage |
| Operation: | write | Name: | DisplayName |
Value: CentraStage | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files (x86)\CentraStage\uninst.exe" | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files (x86)\CentraStage\CSIcon.ico | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage |
| Operation: | write | Name: | URLInfoAbout |
Value: http://www.centrastage.com | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage |
| Operation: | write | Name: | Publisher |
Value: CentraStage Limited | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage |
| Operation: | write | Name: | AgentFolderLocation |
Value: C:\ProgramData\CentraStage | |||
| (PID) Process: | (8436) Confidential_Document.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage |
| Operation: | write | Name: | AgentFolderStatus |
Value: 0 | |||
| (PID) Process: | (8660) CagService.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cag |
| Operation: | write | Name: | URL Protocol |
Value: | |||
| (PID) Process: | (8660) CagService.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001_Classes\cag |
| Operation: | write | Name: | URL Protocol |
Value: | |||
Executable files
118
Suspicious files
37
Text files
317
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFdff9e.TMP | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFdffad.TMP | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFdffad.TMP | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RFdff9e.TMP | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFdffbd.TMP | — | |
MD5:— | SHA256:— | |||
| 3276 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
53
DNS requests
49
Threats
19
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7172 | msedge.exe | GET | 304 | 150.171.27.11:443 | https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist | US | — | — | whitelisted |
5276 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.49:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | binary | 825 b | whitelisted |
5276 | MoUsoCoreWorker.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D | US | binary | 958 b | whitelisted |
— | — | GET | 200 | 23.11.41.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D | NL | binary | 313 b | whitelisted |
7172 | msedge.exe | GET | 200 | 150.171.28.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:u3Y05BeFgwG8Vr96YxjFDbUyYql4vtFXgvbZorG52gI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | US | text | 98 b | whitelisted |
7172 | msedge.exe | GET | 200 | 52.123.224.68:443 | https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=67&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0 | US | text | 4.48 Kb | whitelisted |
7172 | msedge.exe | GET | 200 | 150.171.28.11:443 | https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 | US | text | 132 b | whitelisted |
7172 | msedge.exe | GET | 200 | 172.67.217.19:443 | https://worexa.icu//Document/Confidential_Document.exe | US | executable | 5.00 Mb | unknown |
7172 | msedge.exe | GET | 200 | 104.18.23.222:443 | https://copilot.microsoft.com/c/api/user/eligibility | US | text | 25 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
7984 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 2.16.164.49:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
5276 | MoUsoCoreWorker.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
5532 | SearchApp.exe | 92.123.104.37:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
— | — | 48.192.1.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 23.11.41.157:80 | ocsp.digicert.com | AKAMAI-AMS | NL | whitelisted |
— | — | 204.79.197.203:80 | oneocsp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7172 | msedge.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .icu Domain |
7172 | msedge.exe | Potentially Bad Traffic | ET INFO Suspicious Domain (*.icu) in TLS SNI |
7172 | msedge.exe | Misc activity | ET HUNTING Possible EXE Download From Suspicious TLD |
2232 | svchost.exe | Misc activity | ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net) |
2232 | svchost.exe | Misc activity | ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net) |
8660 | CagService.exe | Misc activity | ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI) |
8660 | CagService.exe | Misc activity | ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI) |
2232 | svchost.exe | Misc activity | ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net) |
2232 | svchost.exe | Misc activity | ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net) |
8660 | CagService.exe | Misc activity | ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI) |