File name:

Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.7z

Full analysis: https://app.any.run/tasks/e33e02af-9abc-4f8a-9bd7-b86f927186cb
Verdict: Malicious activity
Analysis date: April 29, 2025, 15:51:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

18EF6DBA4ADE5857DEA1BA2E4D2811B3

SHA1:

8CAD1CC297B6061E2B6673BF51979F34D0864799

SHA256:

4647713DED8B45022FC1FEA022ACC8D7C4469C66FEACDDB246952D20A95543CF

SSDEEP:

1536:matjg/4YzcdBOK7oIuW7M+ZmyVmvOLbVqF:9j27zcdEK7oIuWp4QVi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Changes the autorun value in the registry

      • usuk.exe (PID: 2772)

    • Modifies files in the Chrome extension folder

      • usuk.exe (PID: 2772)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • WMIC.exe (PID: 2356)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1396)

    • Reads security settings of Internet Explorer

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Reads the date of Windows installation

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Executing commands from a ".bat" file

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 1080)
      • msedge.exe (PID: 3536)

    • Reads settings of System Certificates

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Block-list domains

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Adds/modifies Windows certificates

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Starts itself from another location

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Creates file in the systems drive root

      • usuk.exe (PID: 2772)

    • Reads browser cookies

      • usuk.exe (PID: 2772)

  • INFO

    • Manual execution by a user

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • msedge.exe (PID: 3384)

    • Process checks computer location settings

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2168)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Reads the computer name

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Checks supported languages

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Create files in a temporary directory

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Checks proxy server information

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Reads the software policy settings

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe (PID: 2432)
      • usuk.exe (PID: 2772)

    • Application launched itself

      • msedge.exe (PID: 3384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:03:04 19:10:44+00:00
ArchivedFileName: Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
35
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.win32.purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe wmic.exe no specs vssvc.exe no specs svchost.exe usuk.exe cmd.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3624 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
656"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2188 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
672"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4084 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
676"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4292 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
692"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1632 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3212 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
988"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1108"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3292 --field-trial-handle=1292,i,10155930598367602854,13866863677798047002,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1396C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
62 472
Read events
62 030
Write events
426
Delete events
16

Modification events

(PID) Process:(1080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
D4DA6D42058C
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2168) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.7z
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2168) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
2
Suspicious files
3 440
Text files
387
Unknown types
5

Dropped files

PID
Process
Filename
Type
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e2aab3270fbd67c0f223beb794d0a804_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:29F710C4DCE07B26CF94452FA10DBCA1
SHA256:CE3A01E88B51D062082302197F5DD7FE44D9585A017FF8644D44B4AEF044E2B1
1080svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\CabA831.tmpcompressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4F3E8D8AE2151BD5B73D29FF2BF40AF1_78FAC4979CF576ED1AE23B2DDDF9066Fbinary
MD5:ED9DBA22D1EB24A2602A2C477D3515C1
SHA256:4C888BF34DB3E11DBB59C814DABB07E18BE28D7D151F5BDA1728CB1FAC67FF8E
2772usuk.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2fc69e262ff00f62858966d19107027e_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:6801DE6C3114B4E672D6F702E5E326BD
SHA256:E00D699A0E8E0A812352B818D4CADB86BF94F7B3D72A181075F35D726A38B4A2
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\Public\Desktop\KEYbinary
MD5:08FC1B125CBCA245C4C4E5E9907832C1
SHA256:7E203FCBC592DFDC7ED1160DBF96182E8202B8F63BEFF77D708F1D0A235EF33C
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e5c2a7ab6b2ddfe46b77fc3505e1c4b0_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:CE62F008AD11C2F7FDAC096CB54C0378
SHA256:66F9380BB12FDE2D763623A6CE21311A20A4CCAC4CBF9B9611A4A2D2E673929F
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4F3E8D8AE2151BD5B73D29FF2BF40AF1_78FAC4979CF576ED1AE23B2DDDF9066Fbinary
MD5:A731B3BBAABA5AB44E9707BCF62B1656
SHA256:FDDF87B110C2CC639705FBF596E8A9EF4C681A016ADCB11CC0A395CA53FC2736
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\admin\AppData\Roaming\Raty\usuk.exeexecutable
MD5:7B76433B7EC9F02556083474C8DBE5D2
SHA256:1FC9DF7944B059D2DE8759AC8593DE617B3B5473609F1937C507A2B845E4A432
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\admin\AppData\Local\Temp\tmp_0c64a1bb.battext
MD5:D5BF08ABE8D4CB5ECEF9BB176848ADCF
SHA256:C5F58C220B01393B3C3E61387A4720B5E58E21C4126A91240EC0384FBFB5E675
2432Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
46
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
POST
301
144.202.70.158:80
http://i56bvhjey5gzakmd.onion.pw/gate
unknown
—
—
malicious
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?895e8458d2d829fb
unknown
—
—
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
GET
200
2.23.227.210:80
http://r10.i.lencr.org/
unknown
—
—
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
GET
200
2.16.168.113:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgU3NapuaGZsp6UOj9fWI9GsjQ%3D%3D
unknown
—
—
whitelisted
3536
msedge.exe
GET
204
150.171.74.11:80
http://edge-http.microsoft.com/captiveportal/generate_204
unknown
—
—
whitelisted
3536
msedge.exe
GET
200
23.209.209.135:80
http://x1.i.lencr.org/
unknown
—
—
whitelisted
3536
msedge.exe
GET
200
2.23.227.205:80
http://r10.i.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
103.198.0.111:80
i56bvhjey5gzakmd.onion.link
—
—
malicious
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
208.117.43.225:443
i56bvhjey5gzakmd.onion.top
STEADFAST
US
malicious
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
144.202.70.158:80
i56bvhjey5gzakmd.onion.pw
AS-CHOOPA
US
unknown
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
144.202.70.158:443
i56bvhjey5gzakmd.onion.pw
AS-CHOOPA
US
unknown
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
2.23.227.210:80
r10.i.lencr.org
Ooredoo Q.S.C.
QA
whitelisted
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
  • 142.251.36.78
whitelisted
i56bvhjey5gzakmd.onion.link
  • 103.198.0.111
unknown
i56bvhjey5gzakmd.onion.to
  • —
whitelisted
i56bvhjey5gzakmd.onion.sx
  • —
unknown
i56bvhjey5gzakmd.onion.top
  • 208.117.43.225
malicious
i56bvhjey5gzakmd.onion.pw
  • 144.202.70.158
unknown
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
r10.i.lencr.org
  • 2.23.227.210
  • 2.23.227.205
whitelisted
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r10.o.lencr.org
  • 2.16.168.113
  • 2.16.168.117
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DNS Query to .onion proxy Domain (onion.link)
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1080
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to .onion proxy Domain (onion.top)
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query to .onion proxy Domain (onion. sx)
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query to .onion proxy Domain (onion.to)
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query to .onion proxy Domain (onion. pw)
2432
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.exe
Misc activity
ET INFO HTTP Request to a *.pw domain
3536
msedge.exe
Misc activity
ET INFO DNS Query to .onion proxy Domain (onion.link)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Purgen.tc-1fc9df7944b059d2de8759ac8593de617b3b5473609f1937c507a2b845e4a432.7z