File name:

Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.7z

Full analysis: https://app.any.run/tasks/fcbbed18-0f03-491f-a038-703f4649ed6b
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 14:08:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

42B69690D7DBD9B803A61127445B062F

SHA1:

0E43F954E9E1EA53E5A66707A81AFE3852F364DB

SHA256:

4DCCAF9D45FB387AFE0B02A2EAD3CC0A36B4138D3C174669E8E3F2B39B89F75F

SSDEEP:

1536:UUAFmlY32lMQbgAwAARTj8HbIVEZGtk38Vbq5N2gv2pobbD:UUAFT2zbgAwtMet/8wMfD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Deletes shadow copies

      • cmd.exe (PID: 3140)

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • RANSOMWARE has been detected

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2412)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Executing commands from a ".bat" file

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3140)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3140)

    • Likely accesses (executes) a file from the Public directory

      • msedge.exe (PID: 3656)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

  • INFO

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)
      • msedge.exe (PID: 3656)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2848)

    • Checks supported languages

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Create files in a temporary directory

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe (PID: 1500)

    • Application launched itself

      • msedge.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2019:01:12 09:31:46+00:00
ArchivedFileName: Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
26
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe THREAT trojan-ransom.win32.purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs attrib.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
872"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6e5af598,0x6e5af5a8,0x6e5af5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1500"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1568"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4180 --field-trial-handle=1308,i,14783538391846297075,2716763661024877273,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1580"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4348 --field-trial-handle=1308,i,14783538391846297075,2716763661024877273,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1768"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1308,i,14783538391846297075,2716763661024877273,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1804"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3928 --field-trial-handle=1308,i,14783538391846297075,2716763661024877273,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2244"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3988 --field-trial-handle=1308,i,14783538391846297075,2716763661024877273,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2412C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2432vssadmin.exe Delete Shadows /All /QuietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2848"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
6 285
Read events
6 219
Write events
60
Delete events
6

Modification events

(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2848) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.7z
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
384
Text files
97
Unknown types
10

Dropped files

PID
Process
Filename
Type
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\admin\AppData\Local\Temp\__t4DDC.tmp.battext
MD5:32D8F7A3D0C796CEE45F64B63C1CCA38
SHA256:1A6F73B5C28D1C10F63F2056068C1DE61487B8CF8F1DCF7516548DF144B3E9EA
2848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2848.532\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeexecutable
MD5:783170CCBEA4DE7BC971CE4CF7922C0D
SHA256:713B99B925C3CB7357E956E98B25009CDD1AED782F88254D05806A7126935E22
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\Public\Videos\Sample Videos\Wildlife.wmv —
MD5:—
SHA256:—
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\Public\Videos\Sample Videos\Wildlife.wmv.707 —
MD5:—
SHA256:—
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\admin\AppData\Local\Temp\{e29ac6c0-7037-11de-816d-806e6f6e6963}text
MD5:694CFD2616110EA338B12199E7287D4C
SHA256:BCA74B785E4DDF66190E30BFA3AA29C907B444A6799CBB05629966591DD34957
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\config.sysbinary
MD5:24581DD0C47781EA43A4FC59918E9C50
SHA256:600E990DE50901D2FA6E1EBE9188A142380ADA65EA8BCDFC8A65F395B8A48F3A
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeexecutable
MD5:783170CCBEA4DE7BC971CE4CF7922C0D
SHA256:713B99B925C3CB7357E956E98B25009CDD1AED782F88254D05806A7126935E22
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\Users\desktop.ini.707binary
MD5:3B5B417A16969D00CDBFA655F79136C7
SHA256:0B9D2108113F926DFF0550A0DB170558D261B4B5DA080D2A4EF9C522C36A8B05
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\config.sys.707binary
MD5:24581DD0C47781EA43A4FC59918E9C50
SHA256:600E990DE50901D2FA6E1EBE9188A142380ADA65EA8BCDFC8A65F395B8A48F3A
1500Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.exeC:\autoexec.batbinary
MD5:F7F29D2485ECB54172E8359D9CA24C7A
SHA256:96BD57297479DEA69BBC233287EFD5D9ECF80BB7414910BB34A22B8EC9FA57F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
19
Threats
6

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3236
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3656
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3236
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3236
msedge.exe
172.67.71.135:443
serv1.xyz
CLOUDFLARENET
US
malicious
3236
msedge.exe
35.190.80.1:443
a.nel.cloudflare.com
GOOGLE
US
whitelisted
3236
msedge.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
3236
msedge.exe
103.198.0.111:443
n224ezvhg4sgyamb.onion.link
—
—
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
serv1.xyz
  • 172.67.71.135
  • 104.26.4.59
  • 104.26.5.59
malicious
a.nel.cloudflare.com
  • 35.190.80.1
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.221
  • 2.23.227.208
whitelisted
n224ezvhg4sgyamb.onion.link
  • 103.198.0.111
malicious
supp7.freshdesk.com
  • 162.159.140.147
  • 172.66.0.145
shared

Threats

PID
Process
Class
Message
3236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3236
msedge.exe
Misc activity
ET INFO DNS Query to .onion proxy Domain (onion.link)
3236
msedge.exe
Misc activity
ET INFO DNS Query to .onion proxy Domain (onion.link)
3236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible Abuse Customer Service with Ticketing (.freshdesk .com)
3236
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible Abuse Customer Service with Ticketing (.freshdesk .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Purgen.fk-713b99b925c3cb7357e956e98b25009cdd1aed782f88254d05806a7126935e22.7z