File name:

DownloadedOneDriveDocument.exe

Full analysis: https://app.any.run/tasks/58b8491c-61d3-489e-aa5a-e3220e4d4815
Verdict: Malicious activity
Analysis date: March 26, 2026, 20:06:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
datto
rmm-tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections
MD5:

629CE6EB0387A8F72D72D43FA6D74521

SHA1:

4FC85D62D4ECBB29DE2DD2A0547BD0F0E38696DF

SHA256:

93A09E54E607930DFC068FCBC7EA2C2EA776C504AA20A8CA12100A28CFDCC75A

SSDEEP:

98304:hAe6WTv7klWurdCC9yy2pb+KfO2z7jLDYL0vicZvXq94H+q2xzySMDMNjwZruhAz:6ZNrQ/DYMgNe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • RMM.WebRemote.exe (PID: 2220)

    • Registers / Runs the DLL via REGSVR32.EXE

      • CagService.exe (PID: 6632)

    • DATTO has been detected

      • CagService.exe (PID: 6632)
      • AEMAgent.exe (PID: 2000)

    • Changes settings of System certificates

      • AEMAgent.exe (PID: 2000)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)

    • Executes as Windows Service

      • CagService.exe (PID: 6632)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DownloadedOneDriveDocument.exe (PID: 8164)

    • Executable content was dropped or overwritten

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)
      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Creates or modifies Windows services

      • CagService.exe (PID: 6632)

    • Searches for installed software

      • CagService.exe (PID: 6632)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 5716)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Suspicious use of NETSH.EXE

      • AEMAgent.exe (PID: 2000)

    • Adds/modifies Windows certificates

      • AEMAgent.exe (PID: 2000)

  • INFO

    • Checks supported languages

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • Gui.exe (PID: 6428)
      • CagService.exe (PID: 6632)
      • AEMAgent.exe (PID: 5284)
      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Create files in a temporary directory

      • DownloadedOneDriveDocument.exe (PID: 8164)

    • Creates files in the program directory

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)
      • Gui.exe (PID: 6428)
      • AEMAgent.exe (PID: 5284)
      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Creates a software uninstall entry

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)

    • DATTO has been detected

      • CagService.exe (PID: 6632)
      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)
      • Gui.exe (PID: 6428)
      • AEMAgent.exe (PID: 5284)
      • conhost.exe (PID: 2952)
      • conhost.exe (PID: 3996)
      • AEMAgent.exe (PID: 2000)
      • conhost.exe (PID: 6844)
      • conhost.exe (PID: 7176)
      • conhost.exe (PID: 1824)
      • conhost.exe (PID: 3612)
      • AEMAgent.exe (PID: 2000)
      • conhost.exe (PID: 7992)
      • conhost.exe (PID: 5708)
      • conhost.exe (PID: 2724)
      • RMM.WebRemote.exe (PID: 2220)
      • conhost.exe (PID: 4504)
      • conhost.exe (PID: 1352)
      • conhost.exe (PID: 7516)
      • conhost.exe (PID: 3048)
      • conhost.exe (PID: 4692)

    • Reads the computer name

      • CagService.exe (PID: 6632)
      • DownloadedOneDriveDocument.exe (PID: 8164)
      • Gui.exe (PID: 6428)
      • AEMAgent.exe (PID: 2000)
      • RMM.WebRemote.exe (PID: 2220)

    • Reads the machine GUID from the registry

      • CagService.exe (PID: 6632)
      • Gui.exe (PID: 6428)
      • AEMAgent.exe (PID: 2000)

    • There is functionality for taking screenshot (YARA)

      • DownloadedOneDriveDocument.exe (PID: 8164)

    • Launching a file from a Registry key

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • RMM.WebRemote.exe (PID: 2220)

    • The sample compiled with english language support

      • DownloadedOneDriveDocument.exe (PID: 8164)
      • CagService.exe (PID: 6632)
      • AEMAgent.exe (PID: 2000)

    • Reads security settings of Internet Explorer

      • CagService.exe (PID: 6632)
      • Gui.exe (PID: 6428)
      • netsh.exe (PID: 144)
      • netsh.exe (PID: 7160)
      • netsh.exe (PID: 7176)

    • Creates files or folders in the user directory

      • Gui.exe (PID: 6428)

    • Reads Environment values

      • CagService.exe (PID: 6632)

    • Disables trace logs

      • CagService.exe (PID: 6632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:27 01:27:51+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.26
CodeSize: 35328
InitializedDataSize: 38912
UninitializedDataSize: 154112
EntryPoint: 0x4167
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
38
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start downloadedonedrivedocument.exe cagservice.exe conhost.exe no specs gui.exe no specs regsvr32.exe no specs regsvr32.exe no specs aemagent.exe no specs aemagent.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs rmm.webremote.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs downloadedonedrivedocument.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
144"C:\WINDOWS\system32\netsh.exe" advfirewall firewall show rule name=allC:\Windows\System32\netsh.exe—AEMAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
508"C:\WINDOWS\system32\netsh.exe" advfirewall firewall delete rule name="RMM.WebRemote 14.8.3.10670"C:\Windows\System32\netsh.exe—AEMAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yesC:\Windows\System32\netsh.exe—AEMAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1904"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="RMM.WebRemote 14.8.3.10670" dir=out action=allow program="C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.8.3.10670\RMM.WebRemote.exe" enable=yesC:\Windows\System32\netsh.exe—AEMAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2000"C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe"C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe
CagService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
RMM Agent
Version:
14.8.1.10349
Modules
Images
c:\programdata\centrastage\aemagent\aemagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2220"C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.8.3.10670\RMM.WebRemote.exe" --web-remote-daemon aemwr-c0bc2e27-c9fd-4a94-8224-ff2c19774808C:\ProgramData\CentraStage\AEMAgent\RMM.WebRemote\14.8.3.10670\RMM.WebRemote.exe
AEMAgent.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
RMM WebRemote Agent
Version:
14.8.3.10670
Modules
Images
c:\programdata\centrastage\aemagent\rmm.webremote\14.8.3.10670\rmm.webremote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2368"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="AEMAgent" dir=in action=allow program="C:\ProgramData\CentraStage\AEMAgent\AEMAgent.exe" enable=yesC:\Windows\System32\netsh.exe—AEMAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2524"C:\Users\admin\AppData\Local\Temp\DownloadedOneDriveDocument.exe" C:\Users\admin\AppData\Local\Temp\DownloadedOneDriveDocument.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\downloadedonedrivedocument.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
16 067
Read events
15 957
Write events
93
Delete events
17

Modification events

(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CentraStage
Value:
C:\Program Files (x86)\CentraStage\Gui.exe
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:DisplayName
Value:
CentraStage
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\CentraStage\uninst.exe"
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\CentraStage\CSIcon.ico
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:URLInfoAbout
Value:
http://www.centrastage.com
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:Publisher
Value:
CentraStage Limited
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage
Operation:writeName:AgentFolderLocation
Value:
C:\ProgramData\CentraStage
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage
Operation:writeName:AgentFolderStatus
Value:
0
(PID) Process:(8164) DownloadedOneDriveDocument.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%systemroot%\system32\FirewallControlPanel.dll,-12122
Value:
Windows Defender Firewall
(PID) Process:(6632) CagService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage
Operation:writeName:AgentFolderStatus
Value:
3
Executable files
419
Suspicious files
23
Text files
94
Unknown types
5

Dropped files

PID
Process
Filename
Type
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\Gui.exe.configxml
MD5:29D78BFD9A4C0D4F850250C25CA8112D
SHA256:71B4F6772FE48A80281E0D112DCB0A2FCAF99DA736A07FCA4CAA3E8107BF4AB0
8164DownloadedOneDriveDocument.exeC:\Users\admin\AppData\Local\Temp\nsfFC82.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dllexecutable
MD5:0F581E56ED5BA500CE5D98D105B04A37
SHA256:F041747B5B6B20B6620CA13A7B276C9E9070E54CDA8C29F6ADD54CBA9A42A2F5
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dllexecutable
MD5:EDC5E696C4AD70F0BE6301F703AB3672
SHA256:C6E5F17B2BC91202A1C6A9F3F0547CD7F208368B4CFEBB53F234A55F87C5ACD5
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\defaultbrand.zipcompressed
MD5:BE0A3C9E7408BDD9A9D9D004CA01ABF2
SHA256:865CC74F5B77E1DDFFA260084633236186F16139E08B4FB81DB4AAD2442BDC34
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\CagService.exeexecutable
MD5:975354D0A22C4A77E27624BFCB05777E
SHA256:EB209F6ECCDEBCA405183DE5F24EF34EE8C850615E6AB9F086F5A4FB6851E071
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\Gui.exeexecutable
MD5:53DBDACADB12D1075036068693A5A390
SHA256:5CB69D880A0CEB97926036DEBB3E01EA2095E8766F49CEDF27658A18002CF217
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dllexecutable
MD5:06B971620BDA7960F7D8E43CE69E3BBE
SHA256:B635BA89E9CC8455F252B7E24E5D2838F50AAF75121CA7D070BB7D6CF41A6235
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\Core.dllexecutable
MD5:36FD5269D81B6296A49C84D139A6693B
SHA256:4D47BBB4FF0B6739FB6E069087B6D73B0E2EBC173DA9FA47A3A94FCBC506D9F3
8164DownloadedOneDriveDocument.exeC:\Program Files (x86)\CentraStage\Core.XmlSerializers.dllbinary
MD5:839EBB0C02F5FA42A3BAA3A6011F0B72
SHA256:EB627549FA4BA8DFEDBE22AB7DDA5EF750EE29A588AE8760B73FF39F6AF3CC1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
41
DNS requests
27
Threats
24

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4044
svchost.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
—
—
whitelisted
6632
CagService.exe
GET
—
2.19.126.156:443
https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.21/dotnet-runtime-8.0.21-win-x64.zip
unknown
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6632
CagService.exe
GET
200
3.160.150.87:443
https://update-zinfandel.centrastage.net/cagupdate/aem-agent/version.json
unknown
text
1.22 Kb
unknown
6632
CagService.exe
POST
—
3.33.246.235:443
https://zinfandel-agent.centrastage.net/cs/services/CentraStage
unknown
—
—
unknown
6212
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6212
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6632
CagService.exe
GET
200
3.160.150.87:443
https://update-zinfandel.centrastage.net/cagupdate/aem-agent/10349/win/AEMAgentDeploy.netcore-win-x64.14.8.1.10349.zip
unknown
compressed
5.00 Mb
unknown
3280
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
23.55.110.193:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4044
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3428
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.127.139
  • 142.251.127.113
  • 142.251.127.102
  • 142.251.127.100
  • 142.251.127.101
  • 142.251.127.138
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.67
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
03cc.centrastage.net
  • 34.210.221.105
whitelisted
www.bing.com
  • 92.123.104.16
  • 92.123.104.17
  • 92.123.104.24
  • 92.123.104.18
  • 92.123.104.21
  • 92.123.104.29
  • 92.123.104.14
  • 92.123.104.19
  • 92.123.104.20
whitelisted

Threats

PID
Process
Class
Message
4044
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net)
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6632
CagService.exe
Misc activity
ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
6632
CagService.exe
Misc activity
ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6632
CagService.exe
Misc activity
ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
2232
svchost.exe
Misc activity
ET REMOTE_ACCESS DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6632
CagService.exe
Misc activity
ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
6632
CagService.exe
Misc activity
ET REMOTE_ACCESS Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DownloadedOneDriveDocument.exe