URL:

https://cold7.gofile.io/download/web/df6c6a1c-1442-4173-bb00-4074f752cb44/azuragen.exe

Full analysis: https://app.any.run/tasks/88204ffb-8c48-4f1a-9fcd-98515d9f859a
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: March 23, 2025, 15:25:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
fileshare
python
stealer
evasion
exela
autorun-download
discord
screenshot
Indicators:
MD5:

2117DEB8F52F5059DF38F7A1AF3BFD15

SHA1:

34C074ED2FCA18D362F433C74A3FB176671EE925

SHA256:

2495991151468CB42E7A478590499647ED11564BF55ACDBC61C825FD2CEE4BAD

SSDEEP:

3:N8XPyDp1LcT7nIyS/ITQ0RKEfCECpCn:2KDp6P1uysEfEC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • azuragen.exe (PID: 8788)

    • Actions looks like stealing of personal data

      • azuragen.exe (PID: 8788)

    • Steals credentials from Web Browsers

      • azuragen.exe (PID: 8788)

    • ExelaStealer has been detected

      • azuragen.exe (PID: 8788)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 7416)
      • net.exe (PID: 6564)
      • net.exe (PID: 2552)
      • net.exe (PID: 6080)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 8072)
      • cmd.exe (PID: 7416)
      • net.exe (PID: 8480)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 8364)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8040)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msedge.exe (PID: 7316)
      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)

    • Executable content was dropped or overwritten

      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)
      • csc.exe (PID: 7800)

    • Process drops python dynamic module

      • azuragen.exe (PID: 8760)

    • The process drops C-runtime libraries

      • azuragen.exe (PID: 8760)

    • Application launched itself

      • azuragen.exe (PID: 8760)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 7492)

    • Loads Python modules

      • azuragen.exe (PID: 8788)

    • Get information on the list of running processes

      • azuragen.exe (PID: 8788)
      • cmd.exe (PID: 8900)
      • cmd.exe (PID: 8200)
      • cmd.exe (PID: 1676)
      • cmd.exe (PID: 7416)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 9004)
      • WMIC.exe (PID: 8220)
      • WMIC.exe (PID: 7236)

    • Starts CMD.EXE for commands execution

      • azuragen.exe (PID: 8788)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 7492)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 8892)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 7228)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 9164)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8688)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 8932)
      • cmd.exe (PID: 9036)
      • cmd.exe (PID: 7260)
      • cmd.exe (PID: 8208)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 6876)
      • cmd.exe (PID: 7212)
      • cmd.exe (PID: 8396)
      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 8448)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2560)
      • cmd.exe (PID: 8364)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8568)
      • cmd.exe (PID: 8620)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 7400)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 7416)

    • Checks for external IP

      • azuragen.exe (PID: 8788)
      • svchost.exe (PID: 2196)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 7416)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 7416)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 7416)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 7416)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8984)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 7416)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7416)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 7608)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 8364)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 8364)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 8364)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 7416)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7800)

    • Captures screenshot (POWERSHELL)

      • powershell.exe (PID: 8040)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 7576)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6036)
      • msedge.exe (PID: 7316)

    • Checks supported languages

      • identity_helper.exe (PID: 7576)
      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)
      • chcp.com (PID: 8576)
      • chcp.com (PID: 8692)
      • csc.exe (PID: 7800)
      • cvtres.exe (PID: 6192)

    • Application launched itself

      • msedge.exe (PID: 6036)

    • Reads the computer name

      • identity_helper.exe (PID: 7576)
      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)

    • The sample compiled with english language support

      • msedge.exe (PID: 7316)
      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)

    • Autorun file from Downloads

      • msedge.exe (PID: 8632)
      • msedge.exe (PID: 6036)

    • Create files in a temporary directory

      • azuragen.exe (PID: 8760)
      • azuragen.exe (PID: 8788)
      • cvtres.exe (PID: 6192)
      • csc.exe (PID: 7800)

    • Checks operating system version

      • azuragen.exe (PID: 8788)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 9004)
      • WMIC.exe (PID: 4428)
      • WMIC.exe (PID: 4188)
      • WMIC.exe (PID: 8220)
      • WMIC.exe (PID: 7236)

    • Autorun file from Startup directory

      • azuragen.exe (PID: 8788)

    • Creates files or folders in the user directory

      • azuragen.exe (PID: 8788)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 8324)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8620)
      • cmd.exe (PID: 8568)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 8344)

    • Reads the time zone

      • net1.exe (PID: 3132)
      • net1.exe (PID: 2984)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 8920)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 7800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
286
Monitored processes
151
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs azuragen.exe #EXELASTEALER azuragen.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs chcp.com no specs cmd.exe no specs powershell.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs netsh.exe no specs systeminfo.exe no specs svchost.exe tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3764 --field-trial-handle=2196,i,1719789803545708200,2284428834882162407,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2196,i,1719789803545708200,2284428834882162407,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240C:\WINDOWS\system32\cmd.exe /c "taskkill /F /PID 7560"C:\Windows\System32\cmd.exe—azuragen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1660C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1676C:\WINDOWS\system32\cmd.exe /c "tasklist /FO LIST"C:\Windows\System32\cmd.exe—azuragen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2140"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x28c,0x30c,0x310,0x304,0x230,0x7ffc886a5fd8,0x7ffc886a5fe4,0x7ffc886a5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
30 427
Read events
30 408
Write events
19
Delete events
0

Modification events

(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6036) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
FDE21A609A8F2F00
(PID) Process:(6036) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
D8FD22609A8F2F00
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262924
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0949AA0E-B35D-4930-A293-2C7619998563}
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262924
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5F50BDE4-DD4B-4348-93A9-AA8027AE2151}
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262924
Operation:writeName:WindowTabManagerFileMappingId
Value:
{47FE5B00-3955-468F-8301-25AD32A3209B}
(PID) Process:(6036) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262924
Operation:writeName:WindowTabManagerFileMappingId
Value:
{3F95A817-8BE6-4E5E-AAFE-52642C7FFC38}
Executable files
46
Suspicious files
110
Text files
67
Unknown types
0

Dropped files

PID
Process
Filename
Type
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b548.TMP —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b548.TMP —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b558.TMP —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b548.TMP —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b577.TMP —
MD5:—
SHA256:—
6036msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
53
DNS requests
56
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7748
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7884
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7884
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8788
azuragen.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6036
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7316
msedge.exe
52.123.243.88:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
DE
whitelisted
7316
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7316
msedge.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7316
msedge.exe
94.139.32.5:443
cold7.gofile.io
Enix SAS
BE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.158
  • 23.48.23.147
  • 23.48.23.146
  • 23.48.23.156
  • 23.48.23.162
  • 23.48.23.145
  • 23.48.23.143
  • 23.48.23.138
whitelisted
config.edge.skype.com
  • 52.123.243.88
  • 52.123.243.80
  • 52.123.243.68
  • 52.123.224.72
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
cold7.gofile.io
  • 94.139.32.5
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
bzib.nelreports.net
  • 23.50.131.78
  • 23.50.131.74
whitelisted
gofile.io
  • 51.91.7.6
  • 45.112.123.126
whitelisted

Threats

PID
Process
Class
Message
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Misc activity
ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
7316
msedge.exe
Misc activity
ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7316
msedge.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cold7.gofile.io/download/web/df6c6a1c-1442-4173-bb00-4074f752cb44/azuragen.exe